CVE-2023-28150
📋 TL;DR
This vulnerability allows attackers to perform XML External Entity (XXE) injection attacks by uploading malicious DOCX files containing remote DTD references to systems using Independentsoft JODF. It affects applications that process DOCX files with vulnerable versions of the JODF library, potentially leading to data disclosure or server-side request forgery.
💻 Affected Systems
- Independentsoft JODF
📦 What is this software?
Jodf by Independentsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through file system access, sensitive data exfiltration, or internal network reconnaissance via server-side request forgery.
Likely Case
Unauthorized file read access on the server, disclosure of configuration files, or limited internal network scanning.
If Mitigated
Attack blocked at file upload stage with proper validation; no impact if XXE processing is disabled.
🎯 Exploit Status
XXE exploitation is well-documented and requires only a crafted DOCX file. No authentication needed if file upload functionality is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.110
Vendor Advisory: https://www.independentsoft.de/jword/index.html
Restart Required: No
Instructions:
1. Update JODF library to version 1.1.110 or later. 2. Replace the JODF JAR file in your application dependencies. 3. Rebuild and redeploy your application.
🔧 Temporary Workarounds
Disable XXE processing
allConfigure XML parser to disable external entity resolution
Set XML parser properties: FEATURE_SECURE_PROCESSING = true, DISALLOW_DOCTYPE_DECL = true
File type validation
allImplement strict validation of uploaded DOCX files before processing
🧯 If You Can't Patch
- Implement network segmentation to restrict outbound connections from affected servers
- Deploy WAF rules to block malicious DOCX file uploads containing XXE payloads
🔍 How to Verify
Check if Vulnerable:
Check JODF library version in application dependencies. If version < 1.1.110, the system is vulnerable.Check Version:
Check Maven/Gradle dependencies or examine JAR manifest: java -jar jodf.jar (if standalone) or check pom.xml/gradle.build filesVerify Fix Applied:
Verify JODF library version is 1.1.110 or higher in deployed application.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns
- XML parsing errors with external entity references
- Outbound connections to unusual domains during file processing
Network Indicators:
- HTTP requests to external DTD URLs from server during DOCX processing
- Unusual outbound traffic patterns following file uploads
SIEM Query:
source="application_logs" AND ("XXE" OR "DOCTYPE" OR "ENTITY") AND "DOCX"