CVE-2014-0119

What it actually does

The flaw permits an attacker-supplied XSLT stylesheet to influence the XML parser's class loader, enabling XML external entity expansion that reads arbitrary files on the server or files belonging to other web applications hosted on the same Tomcat instance.

Why it matters to the business

Attackers can obtain sensitive configuration files, application source, or data belonging to any web application on the server, leading to information disclosure that may facilitate further compromise or regulatory exposure.

How an attack unfolds

An attacker deploys or influences a web application containing a malicious XSLT stylesheet that declares an external entity referencing local files; when the stylesheet is processed, Tomcat's XML parser resolves the entity and returns the file contents to the attacker.

How to fix it

Upgrade Apache Tomcat to version 6.0.40 or later, 7.0.54 or later, or 8.0.6 or later. If immediate upgrade is not possible, restrict untrusted XSLT processing and disable external entity resolution in XML parsers used by applications.

How to confirm the fix worked

Verify the installed Tomcat version against the fixed releases; test by submitting an XXE-bearing XSLT payload and confirming that entity expansion is blocked and no file contents are returned.

Typical attack path

1. Identify a Tomcat-hosted application that accepts or processes XSLT stylesheets
2. Craft a stylesheet containing an XXE payload targeting server files or cross-application resources
3. Submit the stylesheet via the application's normal upload or processing interface
4. Receive file contents in the parser response or error output

How to detect it

Review web server and application logs for unusual XSLT processing requests, error messages containing file paths or entity declarations, and unexpected file-read activity originating from Tomcat processes.

What your security team should do

• Prioritize upgrade of all Tomcat instances to the fixed versions listed in remediation guidance
• Audit applications for any use of XSLT processing and remove or sandbox such functionality where possible
• Implement web application firewall rules that block common XXE patterns in stylesheet uploads