CVE-2022-0272
📋 TL;DR
This XXE vulnerability in detekt allows attackers to read arbitrary files from the server filesystem or perform server-side request forgery by processing malicious XML files. It affects all users of detekt versions before 1.20.0 who process untrusted XML input.
💻 Affected Systems
- detekt static code analysis tool
📦 What is this software?
Detekt by Detekt
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through file disclosure of sensitive data (passwords, keys, config files) leading to lateral movement or data exfiltration.
Likely Case
Unauthorized file read of sensitive configuration files or source code from the server.
If Mitigated
Limited impact if XML parsing is restricted to trusted sources only.
🎯 Exploit Status
Exploitation requires submitting malicious XML to detekt's XML processing functionality. Public proof-of-concept exists in the huntr.dev bounty report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.20.0 and later
Vendor Advisory: https://github.com/detekt/detekt/commit/c965a8d2a6bbdb9bcfc6acfa7bbffd3da81f5395
Restart Required: No
Instructions:
1. Update detekt to version 1.20.0 or later. 2. For Maven: Update pom.xml dependency to <version>1.20.0</version>. 3. For Gradle: Update build.gradle to implementation 'io.gitlab.arturbosch.detekt:detekt-cli:1.20.0'. 4. Rebuild and redeploy applications using detekt.
🔧 Temporary Workarounds
Disable XXE processing
allConfigure XML parser to disable external entity resolution
Set XML parser properties: FEATURE_SECURE_PROCESSING = true, DISALLOW_DOCTYPE_DECL = true
Input validation
allValidate and sanitize XML input before processing
Implement XML schema validation or whitelist trusted XML sources
🧯 If You Can't Patch
- Restrict XML processing to trusted sources only
- Implement network segmentation to isolate detekt instances from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check detekt version: run 'detekt --version' or check build configuration files for version <1.20.0Check Version:
detekt --versionVerify Fix Applied:
Confirm version is 1.20.0 or higher and test with known malicious XML payloads📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from detekt process
- XML parsing errors with external entity references
- Large outbound data transfers after XML processing
Network Indicators:
- Unexpected outbound connections from detekt to internal file servers or external systems
SIEM Query:
process_name:"detekt" AND (file_access:"/etc/passwd" OR file_access:"/proc/self/environ" OR network_connection:internal_ip)