OpenCMS XML External Entity Vulnerability in Admin Import DB Feature

A vulnerability allowing XML External Entity (XXE) attacks has been identified in OpenCMS versions through 20. The issue arises in the Admin Import DB feature, where user-supplied .zip files containing a manifest.xml are processed without adequate security, enabling the exploitation of XXE.

Impact

Exploitation of this vulnerability allows for XML External Entity attacks, which can lead to the disclosure of internal files, and in some cases, the execution of arbitrary code or a denial-of-service condition.

Reproduction

To reproduce this vulnerability, upload a .zip file containing a crafted manifest.xml that exploits the XXE vulnerability by referencing an external entity. The vulnerable OpenCMS version must be 20 or prior.

Remediation

Users can update to OpenCMS version 21.0.1 or later, where this vulnerability has been fixed.