Executive brief
mxGraph is a popular JavaScript library for building interactive diagram and graph applications. The library's XML parsing functionality lacks protections against XML External Entity (XXE) attacks, allowing an attacker to read files from the server or perform denial-of-service attacks if untrusted XML input is processed without proper validation.
Technical details
The vulnerability exists in mxGraphViewImageReader.java's convert() method, which uses SAXParserFactory to parse XML but fails to disable external entity resolution and DOCTYPE declarations. An attacker can craft malicious XML payloads containing external entity definitions to read arbitrary files from the affected system or trigger out-of-memory conditions. The vulnerability requires the application to process user-supplied XML input and affects all versions before 3.7.6. The fix involves setting appropriate SAX parser features (XXE-preventive flags) as demonstrated in ExportServlet.java example code.
Affected products
- JGraph mxGraph before 3.7.6
Timeline
- 2017-11-22: disclosed
- 3.7.6: patched
- 2022-05-14: advisory