Http4S Scala Xml
Monthly
XML External Entity (XXE) injection in http4s-scala-xml's EntityDecoder for scala.xml.Elem (all versions before 0.24.1 and 1.0.0-M39) allows unauthenticated remote attackers who can supply XML message bodies to disclose files readable by the service process, perform server-side request forgery (SSRF) against internal network resources, or trigger denial of service via entity expansion. The decoders obtain a javax.xml.parsers.SAXParserFactory through SAXParserFactory.newInstance without configuring secure-processing features, so JDK default behavior resolves DOCTYPE declarations, external general and parameter entities, and external DTDs. Vendor-released fixes are 0.24.1 and 1.0.0-M39; no public exploit code has been identified at time of analysis, and reachability depends on an application actually using these decoders against untrusted XML.
XML External Entity (XXE) injection in http4s-scala-xml's EntityDecoder for scala.xml.Elem (all versions before 0.24.1 and 1.0.0-M39) allows unauthenticated remote attackers who can supply XML message bodies to disclose files readable by the service process, perform server-side request forgery (SSRF) against internal network resources, or trigger denial of service via entity expansion. The decoders obtain a javax.xml.parsers.SAXParserFactory through SAXParserFactory.newInstance without configuring secure-processing features, so JDK default behavior resolves DOCTYPE declarations, external general and parameter entities, and external DTDs. Vendor-released fixes are 0.24.1 and 1.0.0-M39; no public exploit code has been identified at time of analysis, and reachability depends on an application actually using these decoders against untrusted XML.