CVE-2022-0217

What it actually does

The XML parser based on libexpat fails to disable recursive entity expansion and external entity resolution, allowing crafted DTDs to trigger exponential memory/CPU growth (CWE-776) or external entity fetches (CWE-611).

Why it matters to the business

Attackers can remotely exhaust server resources causing denial of service, or in some configurations read local files and internal network resources, disrupting service availability and risking data exposure on affected Joomla installations.

How an attack unfolds

An unauthenticated attacker submits a malicious XML document containing recursive entity definitions or external entity references through any application feature that uses the vulnerable Prosody XML loader; the parser expands the entities, either consuming excessive resources or retrieving unauthorized content.

How to fix it

Upgrade joomla/joomla-cms to the commit bbdf775fbee26d275ce60ea466b778e4694210a1 or later; disable external entity processing and limit entity expansion in any custom XML handling until the update is applied.

How to confirm the fix worked

Confirm the presence of commit bbdf775fbee26d275ce60ea466b778e4694210a1 in the codebase, then re-test with known recursive-entity and XXE test cases to verify that expansion is rejected and no external fetches occur.

Typical attack path

1. Identify an unauthenticated or low-privilege endpoint that accepts or processes XML data
2. Craft an XML payload with a DTD containing recursive entities or external-entity references
3. Submit the payload to the vulnerable parser
4. Observe resource exhaustion (DoS) or receive responses containing file or network data

How to detect it

Search web-server and application logs for unusually large or malformed XML payloads, repeated entity declarations, or spikes in CPU/memory during XML parsing; correlate with external-entity fetch attempts in outbound traffic logs.

What your security team should do

• Apply the fixed commit bbdf775fbee26d275ce60ea466b778e4694210a1 to all Joomla instances without delay
• Review and harden any remaining XML parsing code to explicitly disable DTDs and external entities
• Monitor server resource usage and XML-processing CPU spikes for signs of exploitation
• Add web-application firewall rules that block or sanitize suspicious XML entity declarations