CVE-2021-41411: Redhat Drools XXE Vulnerability

CVE-2021-41411 Overview

CVE-2021-41411 is an XML External Entity (XXE) vulnerability affecting Red Hat Drools versions 7.59.x and earlier. The vulnerability exists in the KieModuleMarshaller.java component where the Validator class is not used correctly, allowing attackers to inject malicious XML content that can lead to data exfiltration, server-side request forgery, and denial of service.

Critical Impact

This XXE vulnerability allows unauthenticated remote attackers to read arbitrary files from the server, perform server-side request forgery (SSRF), and potentially achieve remote code execution in certain configurations.

Affected Products

• Red Hat Drools versions ≤7.59.x

Discovery Timeline

• 2022-06-16 - CVE CVE-2021-41411 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-41411

Vulnerability Analysis

This XML External Entity (XXE) vulnerability stems from improper XML parsing configuration in the Drools rule engine. The KieModuleMarshaller.java component processes XML input without properly disabling external entity resolution, allowing attackers to inject malicious XML payloads.

When XML parsers are configured to process external entities, attackers can craft XML documents that reference external resources. This can lead to disclosure of sensitive server files, internal network reconnaissance through SSRF, or denial of service through recursive entity expansion (billion laughs attack).

The vulnerability is particularly concerning because Drools is commonly used in enterprise business rule management systems, potentially exposing critical business logic infrastructure to attack.

Root Cause

The root cause of CVE-2021-41411 lies in the improper configuration of the XML Validator class within KieModuleMarshaller.java. When parsing XML input for Kie module marshalling operations, the code fails to disable the following dangerous features:

• External DTD loading
• External general entities
• External parameter entities

Without explicitly setting these secure defaults, the XML parser processes external entity declarations, enabling the XXE attack vector.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can exploit this vulnerability by:

1. Submitting a maliciously crafted XML payload to an endpoint that processes Kie module data
2. The XML payload contains external entity references pointing to local files or internal network resources
3. The vulnerable parser resolves these entities and includes their content in the response or processes them server-side

The exploitation technique typically involves constructing an XML document with a DOCTYPE declaration that defines external entities pointing to sensitive resources such as /etc/passwd on Unix systems or internal service endpoints for SSRF attacks.

Detection Methods for CVE-2021-41411

Indicators of Compromise

• Unusual XML payloads in application logs containing DOCTYPE declarations or ENTITY definitions
• Server-side requests to internal network resources or metadata endpoints (e.g., cloud provider metadata services)
• Unexpected file access patterns, particularly attempts to read sensitive configuration files
• Error messages in logs revealing file paths or internal network information

Detection Strategies

• Monitor incoming requests for XML payloads containing DOCTYPE, ENTITY, or SYSTEM declarations
• Implement Web Application Firewall (WAF) rules to detect and block XXE attack patterns
• Review application logs for stack traces related to XML parsing failures that may indicate exploitation attempts
• Deploy network monitoring to detect unusual outbound connections from application servers

Monitoring Recommendations

• Enable verbose logging for XML parsing operations in Drools-based applications
• Configure alerts for any attempts to access sensitive files like /etc/passwd, /etc/shadow, or application configuration files
• Monitor network traffic for DNS lookups or HTTP requests to unexpected internal or external hosts originating from the application server

How to Mitigate CVE-2021-41411

Immediate Actions Required

• Upgrade Red Hat Drools to a patched version that addresses CVE-2021-41411
• If immediate upgrade is not possible, implement input validation to sanitize XML input before processing
• Deploy WAF rules to block requests containing XXE attack patterns
• Review and restrict network egress from application servers to limit SSRF impact

Patch Information

Red Hat has addressed this vulnerability through a code fix available in the GitHub Pull Request for Drools. Organizations should update to a Drools version that includes this fix. The patch properly configures the XML parser to disable external entity processing.

Workarounds

• Configure XML parsers to disable DTDs entirely by setting XMLConstants.FEATURE_SECURE_PROCESSING to true
• Disable external entities by configuring XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES to false
• Implement a security proxy or WAF that filters XML input containing DOCTYPE declarations
• Restrict network access from application servers to prevent SSRF exploitation

# Example: Verify Drools version in Maven projects
mvn dependency:tree | grep drools

# Check for vulnerable versions (<=7.59.x)
# Update pom.xml to use patched version
# <dependency>
#     <groupId>org.drools</groupId>
#     <artifactId>drools-core</artifactId>
#     <version>[PATCHED_VERSION]</version>
# </dependency>