Lucee Server Remote Code Execution Vulnerability via XML External Entity Attack

A remote code execution vulnerability has been identified in Lucee Server, all prior versions, through an XML external entity (XXE) attack on the Lucee REST endpoint. This issue arises from improper handling of XML data, allowing maliciously crafted XML to be processed in a way that executes arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Lucee is running.

Remediation

Users should upgrade to Lucee versions 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, or 5.3.9.173, all of which have been patched. Instructions for upgrading can be found in the Lucee GitHub repository.