CVE-2022-28890

What it actually does

The RDF/XML parser processes external DTDs, enabling classic XXE attacks that can read arbitrary files, perform SSRF, or trigger denial of service.

Why it matters to the business

Attackers may obtain sensitive internal data or fully compromise systems that ingest untrusted RDF/XML, increasing breach and operational disruption risk; the flaw has been public for over four years with modest but steady exploitability signals.

How an attack unfolds

An attacker supplies a malicious RDF/XML document containing an external entity reference to any Jena-based application that parses untrusted input; the parser resolves the external DTD, allowing data exfiltration or other XXE side-effects.

How to fix it

Upgrade Apache Jena to a release that fully disables external entity resolution in the RDF/XML parser; if immediate upgrade is not possible, configure the underlying XML parser to prohibit external DTDs and entities.

How to confirm the fix worked

Test the patched parser with a known XXE test payload and confirm that external entity resolution is rejected; review application logs for any residual DTD-related warnings after deployment.

Typical attack path

1. Identify an endpoint or API that accepts RDF/XML input processed by Apache Jena
2. Craft an XML document with an external entity declaration pointing to a target resource or attacker-controlled server
3. Submit the payload through normal application channels
4. Observe or capture the resulting file contents, network callbacks, or error responses

How to detect it

Inspect application and XML parser logs for external entity resolution attempts, unexpected outbound network connections initiated by the Jena process, or error messages referencing DTD loading.

What your security team should do

• Prioritize upgrade of all Jena 4.4.0 and earlier deployments within normal change windows
• Add RDF/XML input validation or sandboxing where untrusted data is processed
• Monitor EPSS trend and re-evaluate if exploit code appears