CVE-2017-5662

What it actually does

The vulnerability permits XML external entity (XXE) processing in SVG documents parsed by Apache Batik, allowing an attacker to read arbitrary files from the host filesystem or trigger denial-of-service amplification via crafted entity references.

Why it matters to the business

Attackers can steal sensitive files such as configuration or credentials, leading to data exposure or full server takeover when the application runs with elevated privileges; availability can also be disrupted through resource exhaustion.

How an attack unfolds

An attacker crafts a malicious SVG file containing XXE payloads that reference local files or external resources, submits it to any application using a vulnerable Batik version for rendering or processing, and receives the file contents or causes resource exhaustion in the response.

How to fix it

Upgrade Apache Batik to version 1.9 or later; disable external entity resolution in XML parsers where Batik is used; apply least-privilege execution contexts for the hosting application.

How to confirm the fix worked

Confirm the installed Batik JAR version is 1.9 or newer; attempt controlled XXE test payloads against SVG processing endpoints and verify that external entity expansion is rejected.

Typical attack path

1. Identify an application endpoint that accepts or processes SVG files using Apache Batik
2. Craft an SVG document embedding XXE entities pointing to local filesystem paths or external amplification targets
3. Submit the malicious SVG to the vulnerable parser
4. Receive leaked file contents or observe service degradation from the XXE-induced request amplification

How to detect it

Inspect application logs for XML parser errors or unexpected external entity references; correlate with file-access logs showing reads of sensitive paths by the application process; review web server access logs for SVG uploads followed by anomalous responses containing file contents.

What your security team should do

• Immediately upgrade all Apache Batik deployments to 1.9 or later
• Review and restrict file system permissions for processes that invoke Batik
• Add input validation or sanitization around SVG uploads and processing
• Monitor for unusual XML parsing activity or unexpected file access originating from the application