CVE-2024-28168

What it actually does

Improper restriction of XML external entity references in the XML parser allows untrusted XML input to resolve external entities, enabling arbitrary file reads from the local filesystem or outbound network requests to attacker-controlled servers.

Why it matters to the business

Attackers could access sensitive files on servers running the affected software or use the server to probe internal networks, potentially leading to data exposure or further compromise in document processing workflows; the issue appears in a widely used dependency with downstream packages requiring updates.

How an attack unfolds

An attacker supplies a specially crafted XML document containing malicious external entity declarations to a component that processes user-controlled XML; the vulnerable FOP parser resolves the entities, returning file contents or making network calls back to the attacker.

How to fix it

Upgrade Apache XML Graphics FOP to version 2.10 or later; for the Karmada package, upgrade to version 1.8.0 or later which incorporates the fixed FOP dependency.

How to confirm the fix worked

Confirm the installed FOP version is 2.10 or newer and Karmada version is 1.8.0 or newer; test by submitting an XXE test payload and verifying that external entities are no longer resolved.

Typical attack path

1. Identify an endpoint or feature that accepts XML input for processing
2. Craft an XML payload with external entity references pointing to local files or internal URLs
3. Submit the payload through the affected input channel
4. Receive the resolved entity data in the response or observe network callbacks

How to detect it

Inspect application logs for XML parsing errors or unexpected outbound connections triggered during document processing; review any recent file access or network activity logs associated with the document rendering service.

What your security team should do

• Prioritize upgrade of affected FOP and Karmada installations to the fixed versions within standard change windows
• Review XML processing code paths for any custom entity handling and disable external entity resolution where possible
• Monitor dependency scanners for other downstream projects that embed the vulnerable FOP 2.9 version