Mustang XXE Vulnerability in ZUGFeRDInvoiceImporter Allowing File Exfiltration

A vulnerability in Mustang versions prior to 2.16.3 allows XML External Entity (XXE) attacks, which can be exploited to exfiltrate files. The issue arises because the ZUGFeRDInvoiceImporter component uses a DocumentBuilder that has XXE processing enabled by default, leaving it susceptible to such attacks.

Impact

Exploitation of this vulnerability allows for XXE attacks, where an attacker can manipulate XML data to access or exfiltrate files from the server.

Reproduction

The vulnerability can be reproduced by using the ZUGFeRDInvoiceImporter class to process an XML file that includes external entities. The default DocumentBuilder will parse these entities, leading to potential file exfiltration.

Remediation

Users can upgrade to Mustang version 2.16.3 or later, where this vulnerability has been addressed.