Symfony DomCrawler XXE Vulnerability in addXmlContent Method Allows Local File Disclosure

A vulnerability exists in the Symfony DomCrawler component, specifically in the Crawler class's addXmlContent method, prior to versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12. The issue arises because the method enables DOMDocument's validateOnParse property before loading XML. This reactivates external entity resolution, allowing attacker-controlled XML to access local files by expanding file:// entities. Exploitation could lead to unauthorized disclosure of sensitive file contents, such as the passwd file.

Impact

Exploitation of this vulnerability could result in a local file disclosure, allowing attackers to read sensitive files on the server.

Reproduction

To reproduce this vulnerability, use a version of Symfony DomCrawler prior to the patched releases. Create an XML document that includes a DOCTYPE declaration with an external entity pointing to a local file, such as /etc/passwd. When this XML is processed by the Crawler's addXmlContent method, the external entity will be resolved and the contents of the specified file will be disclosed.

Remediation

Users can upgrade to Symfony versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12 to address this vulnerability.