Junglewise Threat Intelligence

CVE-2017-18197: mxGraph XXE vulnerability in XML parsing

CVE-2017-18197 · Severity: low · CVSS 3 · Published 2022-05-14

Technologies: mxgraph (npm). Vendors: JGraph, npm.

Executive brief

mxGraph is a popular JavaScript library for building interactive diagram and graph applications. The library's XML parsing functionality lacks protections against XML External Entity (XXE) attacks, allowing an attacker to read files from the server or perform denial-of-service attacks if untrusted XML input is processed without proper validation.

Technical details

The vulnerability exists in mxGraphViewImageReader.java's convert() method, which uses SAXParserFactory to parse XML but fails to disable external entity resolution and DOCTYPE declarations. An attacker can craft malicious XML payloads containing external entity definitions to read arbitrary files from the affected system or trigger out-of-memory conditions. The vulnerability requires the application to process user-supplied XML input and affects all versions before 3.7.6. The fix involves setting appropriate SAX parser features (XXE-preventive flags) as demonstrated in ExportServlet.java example code.

Affected products

  • JGraph mxGraph before 3.7.6

Timeline

  • 2017-11-22: disclosed
  • 3.7.6: patched
  • 2022-05-14: advisory

References

Related threats