Oinone Pamirs XML External Entity Vulnerability Allowing File Disclosure or SSRF

An XML External Entity (XXE) vulnerability has been identified in Oinone Pamirs version 7.0.0. This issue arises from the application's XStream-based XML parsing, which is configured to be permissive and allows attacker-controlled XML to be processed unsafely. When such XML is directed to certain framework parsing entry points, it can lead to the resolution of external entities, potentially causing local file disclosure or server-side request forgery (SSRF), depending on the specific deployment and parser configuration.

Impact

Exploitation of this vulnerability could result in unauthorized file access or server-side request forgery, allowing an attacker to make requests from the server's context.

Remediation

Users can upgrade to Oinone Pamirs version 7.2.3, where this vulnerability has been fixed.