EUVD-2025-19057
GHSA-h7qf-qmf3-85qg
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Description
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue.
Analysis
Allure 2 versions prior to 2.34.1 contain a critical XML External Entity (XXE) injection vulnerability in the xunit-xml-plugin that allows unauthenticated remote attackers to read arbitrary files from the server's filesystem and potentially trigger SSRF attacks. The vulnerability stems from insecure XML parser configuration in the DocumentBuilderFactory and is exploitable by uploading or providing malicious test result XML files without any authentication or user interaction required.
Technical Context
The vulnerability exists in the xunit-xml-plugin component used by Allure Report 2.x for parsing JUnit/XUnit test result XML files. The root cause is CWE-611 (Improper Restriction of XML External Entity Reference), which occurs when the XML parser (DocumentBuilderFactory) is not configured to disable external entity expansion and DTD processing. Attackers can craft malicious XML files containing DOCTYPE declarations with external entity definitions pointing to local files (file:// protocol) or remote servers, causing the parser to resolve these entities and leak their contents. This affects the CPE scope: cpe:2.3:a:qameta:allure:2.0:*:*:*:*:*:*:* through cpe:2.3:a:qameta:allure:2.34.0:*:*:*:*:*:*:*, with remediation available in version 2.34.1 and later.
Affected Products
Allure Report (2.0 through 2.34.0)
Remediation
Update dependency/installation: allure-report >= 2.34.1 Workaround (Temporary): Implement pre-processing validation: scan incoming XML for <!DOCTYPE and <!ENTITY patterns; reject or sanitize Defense in Depth: Network isolation, IAM hardening, file access auditing Vendor Advisory: Review: https://github.com/allure-framework/allure2 or vendor security advisory documentation
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today