CVE-2022-0839
📋 TL;DR
This vulnerability allows attackers to perform XML External Entity (XXE) attacks through Liquibase, potentially leading to sensitive data disclosure, server-side request forgery, or denial of service. It affects all users running Liquibase versions before 4.8.0 who process untrusted XML input.
💻 Affected Systems
- Liquibase
📦 What is this software?
Liquibase by Liquibase
Sqlcl by Oracle
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through file disclosure, SSRF to internal services, or denial of service via entity expansion attacks.
Likely Case
Sensitive configuration file disclosure (database credentials, API keys) or limited SSRF to internal network services.
If Mitigated
No impact if XML parsing is properly configured to disable external entity resolution.
🎯 Exploit Status
XXE exploitation is well-documented with many public tools. The vulnerability requires XML input processing but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.8.0 and later
Vendor Advisory: https://github.com/liquibase/liquibase/security/advisories/GHSA-2q89-6c5v-5g5c
Restart Required: No
Instructions:
1. Update Liquibase to version 4.8.0 or later. 2. Update dependency in your project: For Maven: <liquibase.version>4.8.0</liquibase.version>. For Gradle: liquibase '4.8.0'. 3. Rebuild and redeploy applications using Liquibase.
🔧 Temporary Workarounds
Disable XXE in XML parser
allConfigure XML parser to disable external entity resolution before processing untrusted XML
Set XML parser properties: FEATURE_SECURE_PROCESSING=true, disallow-doctype-decl=true
Input validation
allValidate and sanitize XML input before processing with Liquibase
🧯 If You Can't Patch
- Restrict XML input sources to trusted repositories only
- Implement network segmentation to limit SSRF impact
🔍 How to Verify
Check if Vulnerable:
Check Liquibase version: liquibase --version. If version is below 4.8.0, you are vulnerable.Check Version:
liquibase --versionVerify Fix Applied:
Confirm version is 4.8.0 or higher: liquibase --version. Test with known XXE payloads to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- XML parsing errors mentioning external entities
- Unexpected file read operations
- Outbound connections to internal services from Liquibase process
Network Indicators:
- Liquibase process making unexpected HTTP requests to internal services
- Data exfiltration patterns from database servers
SIEM Query:
process_name:"liquibase" AND (event_type:"file_read" OR dest_ip:private_ip_range)🔗 References
- https://github.com/liquibase/liquibase/commit/33d9d925082097fb1a3d2fc8e44423d964cd9381
- https://huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://seclists.org/fulldisclosure/2025/Apr/14
- https://github.com/liquibase/liquibase/commit/33d9d925082097fb1a3d2fc8e44423d964cd9381
- https://huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70
- https://www.oracle.com/security-alerts/cpujul2022.html
