Cloudanix VulnDB

CVE-2017-5661

High · 7.3

CVSS

7.3

EPSS

2.5%

Published

Apr 18, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A document-processing tool could let attackers read private files stored on the server or temporarily shut it down by sending specially made files.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
Library
Class
XXE
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

XXE vulnerability allowing arbitrary file disclosure from the server filesystem and potential denial-of-service amplification attacks when processing malicious SVG documents; impact depends on the process privileges under which FOP runs.

Why it matters to the business

Attackers could access confidential server files or cause service disruption, leading to data exposure, compliance violations, or operational downtime in document-generation workflows; the flaw remains relevant in any unpatched deployments despite its age.

How an attack unfolds

An attacker crafts a malicious SVG containing external entity references and submits it to any application using vulnerable Apache FOP for rendering; the XXE parser resolves the entities against the local filesystem or external resources, leaking file contents or triggering resource exhaustion.

How to fix it

Upgrade Apache FOP to version 2.2 or later in all affected applications; disable external entity resolution in XML parsers if immediate upgrade is impossible; review and restrict file-system permissions of the process account running FOP.

How to confirm the fix worked

Confirm installed FOP version is 2.2 or newer; run controlled XXE test payloads against document-processing endpoints and verify that external entities are no longer resolved; monitor application logs for rejected entity declarations after changes.

Typical attack path

  1. Identify an application endpoint that accepts SVG input and processes it via Apache FOP
  2. Craft SVG payload embedding XXE entity declarations referencing local files or external URLs
  3. Submit the payload through the normal document-processing workflow
  4. Receive file contents in the rendered output or observe service degradation from amplification

How to detect it

Search web-server and application logs for SVG uploads containing XML entity declarations or SYSTEM keywords; monitor for unexpected file-read attempts or high resource usage correlating with document-processing requests; review FOP error logs for entity-resolution failures.

What your security team should do

  • Prioritize upgrade of Apache FOP to 2.2+ across all document-processing services
  • Inventory applications that embed or invoke FOP and schedule remediation within change windows
  • Implement input sanitization or parser hardening as a defense-in-depth layer
  • Add XXE-specific detection rules to web-application firewalls and SIEM

The record

In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.apache.xmlgraphics:fop 0 2.2
Debian:11 fop 0 1:2.1-6
Debian:12 fop 0 1:2.1-6
Debian:13 fop 0 1:2.1-6
Debian:14 fop 0 1:2.1-6
Debian:7 fop 0 1:1.0.dfsg2-6+deb7u1
Debian:8 fop 0 1:1.1.dfsg2-1+deb8u1
Ubuntu:14.04:LTS fop 0 1:1.1.dfsg-2ubuntu1.1
Ubuntu:16.04:LTS fop 0 No fix
Ubuntu:18.04:LTS fop 0 1:2.1-7
Ubuntu:Pro:16.04:LTS fop 0 No fix

Related vulnerabilities