CVE-2025-65482
📋 TL;DR
An XML External Entity (XXE) vulnerability in opensagres XDocReport versions 0.9.2 through 2.0.3 allows attackers to execute arbitrary code by uploading a specially crafted .docx file. This affects any application using vulnerable XDocReport libraries to process Word documents, potentially leading to complete system compromise.
💻 Affected Systems
- opensagres XDocReport
📦 What is this software?
Xdocreport by Opensagres
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Server compromise leading to data theft, backdoor installation, and potential ransomware deployment.
If Mitigated
Limited impact if proper input validation and XML parsing restrictions are in place.
🎯 Exploit Status
Multiple proof-of-concept exploits are publicly available. Exploitation requires only the ability to upload a .docx file to a vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.4 or later
Vendor Advisory: https://github.com/opensagres/xdocreport
Restart Required: Yes
Instructions:
1. Update XDocReport dependency to version 2.0.4 or later. 2. Update pom.xml or build.gradle to reference the fixed version. 3. Rebuild and redeploy the application. 4. Restart the application server.
🔧 Temporary Workarounds
Disable XXE in XML parsers
allConfigure XML parsers to disable external entity resolution
Set XML parser properties: FEATURE_SECURE_PROCESSING = true, DISALLOW_DOCTYPE_DECL = true, EXTERNAL_GENERAL_ENTITIES = false, EXTERNAL_PARAMETER_ENTITIES = false, LOAD_EXTERNAL_DTD = false
Input validation for .docx files
allImplement strict validation and sanitization of uploaded .docx files
Validate file signatures, restrict file uploads to trusted sources, implement file type verification
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy web application firewall (WAF) with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check application dependencies for XDocReport versions 0.9.2 through 2.0.3. Review build files (pom.xml, build.gradle) and deployed libraries.Check Version:
For Maven: mvn dependency:tree | grep xdocreport. For Gradle: gradle dependencies | grep xdocreport. Direct check: java -cp xdocreport.jar org.opensagres.xdocreport.VersionVerify Fix Applied:
Verify XDocReport version is 2.0.4 or later. Test with known malicious .docx files to ensure they are rejected or safely processed.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads of .docx files, XML parsing errors, unexpected outbound connections from application servers
Network Indicators:
- HTTP requests with .docx uploads to vulnerable endpoints, outbound connections to external entities from XML parsers
SIEM Query:
source="application.logs" AND ("xdocreport" OR ".docx upload") AND (status="500" OR "XML parsing error")