PowSyBl XML Parsing Vulnerability Allowing XXE and SSRF

A vulnerability in the PowSyBl framework's XML parsing component, specifically in 'powsybl-core' versions through 6.7.1, allows for XML External Entity (XXE) and Server-Side Request Forgery (SSRF) attacks. The issue arises in the 'com.powsybl.commons.xml.XmlReader' class, which is deemed untrusted when handling XML from users with varying privilege levels. This vulnerability could enable an attacker to read unauthorized files, including sensitive system files.

Impact

Exploitation of this vulnerability could lead to unauthorized file access, allowing attackers to read sensitive files on the system.

Reproduction

The vulnerability can be reproduced by uploading untrusted XML files to an application using the affected PowSyBl version. This can be done through a multi-tenant application that allows users to submit XML, where the 'XmlReader' class processes the input without proper validation, leaving it open to XXE and SSRF attacks.

Remediation

Users can upgrade to PowSyBl version 6.7.2 or later to address this vulnerability.