CVE-2023-6194

What it actually does

Unrestricted XML parsing in report definition files permits external entity resolution, enabling the process to read arbitrary local files or issue outbound network requests to attacker-controlled URLs.

Why it matters to the business

An attacker who supplies a crafted report file can exfiltrate sensitive data from the machine running the analyzer or reach internal resources, increasing risk of data loss or further compromise; the issue has been public for nearly three years with public exploit code available.

How an attack unfolds

An attacker crafts a malicious XML report definition containing a DTD that references an external entity such as a local file or HTTP URL, then tricks a user into loading that file in Eclipse Memory Analyzer; the application parses the XML without disabling external entities and returns or transmits the requested content.

How to fix it

Upgrade Eclipse Memory Analyzer to the first release after 1.14.0 that disables DTD external entities in report XML parsing; if an upgrade is unavailable, configure the underlying XML parser to set FEATURE_SECURE_PROCESSING and disallow external entities, or restrict the tool to trusted report files only.

How to confirm the fix worked

Confirm the installed version is newer than 1.14.0; attempt to load a test XML containing a file:// external entity and verify that the entity is rejected rather than expanded; review application logs for any unexpected file or network access during XML processing.

Typical attack path

1. Attacker prepares malicious report-definition XML containing a DTD external-entity declaration
2. Attacker delivers the XML file to the victim via email, shared storage, or supply-chain compromise
3. Victim opens the file in Eclipse Memory Analyzer to generate a report
4. Parser resolves the external entity, reading local files or contacting attacker URLs
5. Attacker receives exfiltrated file contents or observes successful network callbacks

How to detect it

Search process execution logs and file-access telemetry for the Eclipse Memory Analyzer binary opening unexpected XML files; inspect network logs for outbound connections originating from the analyzer process to non-standard destinations; review XML report files for DOCTYPE declarations containing SYSTEM or PUBLIC identifiers.

• XML containing <!DOCTYPE .* SYSTEM "file:
• XML containing <!ENTITY .* SYSTEM "http:
• Process name mat (or equivalent Eclipse MAT launcher) accessing file:// URIs
• Unexpected outbound HTTP/S connections from mat process to external hosts

What your security team should do

• Prioritize upgrade of all Eclipse Memory Analyzer instances to a patched release
• Add the product to the organization's software inventory and block execution of versions 0.7-1.14.0
• Implement file-type restrictions or sandboxing so only trusted report definitions can be opened
• Monitor EPSS and exploit-availability feeds for any increase in observed exploitation