CVE-2015-3451

What it actually does

The _clone function in XML::LibXML fails to enforce the expand_entities option, permitting external entity resolution in XML parsed via the new or load_xml functions and enabling disclosure of local files or outbound network requests.

Why it matters to the business

Organizations using affected XML parsing code risk exposure of internal files or unintended network access, which can result in data leakage and increased operational risk until the library is updated.

How an attack unfolds

An attacker crafts an XML document containing external entity declarations that reference local files or internal services, submits it through the new or load_xml entry points, and receives the expanded content in the application response or via side-channel timing.

How to fix it

Upgrade XML::LibXML to version 2.0119 or later on all affected platforms; where immediate patching is not feasible, disable external entity processing at the application layer or wrap calls with explicit expand_entities=0.

How to confirm the fix worked

Confirm the installed XML::LibXML version is at least 2.0119, then test the new and load_xml functions with a controlled XXE payload that attempts to read a known local file and verify the payload is rejected.

Typical attack path

1. Identify an application endpoint that accepts XML input using the vulnerable library functions
2. Prepare a malicious XML payload with external entity definitions pointing to sensitive resources
3. Submit the payload and capture the expanded entity data returned by the parser
4. Iterate on entity references to exfiltrate additional files or probe internal network hosts

How to detect it

Search web and application server logs for XML documents containing DOCTYPE or ENTITY declarations, monitor for parser processes accessing unexpected local paths, and inspect outbound connections initiated during XML parsing.

What your security team should do

• Prioritize upgrade of XML::LibXML across all distributions and dependent applications
• Scan codebases for direct calls to new or load_xml and add defensive entity-expansion controls
• Review application logs for XML processing events that reference external entities or unexpected file paths
• Add the library to the vulnerability management inventory with automated version checks