CVE-2021-47621: ClassGraph XXE Vulnerability

CVE-2021-47621 Overview

ClassGraph before version 4.8.112 was vulnerable to XML eXternal Entity (XXE) attacks. This vulnerability allows attackers to exploit the XML parsing functionality within the ClassGraph library, potentially enabling them to read arbitrary files from the server, perform server-side request forgery (SSRF), or cause denial of service through entity expansion attacks.

Critical Impact

An unauthenticated attacker can exploit this XXE vulnerability over the network to access sensitive information such as configuration files, credentials, and other confidential data stored on the server.

Affected Products

• ClassGraph versions prior to 4.8.112
• Applications using vulnerable ClassGraph library as a dependency
• Corda Enterprise (addressed in version 4.8)

Discovery Timeline

• 2024-06-21 - CVE-2021-47621 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-47621

Vulnerability Analysis

This vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The ClassGraph library, which is widely used for classpath scanning and runtime class introspection in Java applications, failed to properly configure its XML parser to disable external entity processing.

When ClassGraph processes XML content (such as module descriptors or configuration files), an attacker can inject malicious XML payloads containing external entity declarations. These entities can reference local files on the server's filesystem or external URLs, allowing the attacker to exfiltrate sensitive data or probe internal network resources.

The vulnerability requires no authentication and can be exploited remotely over the network. Successful exploitation results in confidentiality breaches where attackers can read arbitrary files accessible by the application process.

Root Cause

The root cause of this vulnerability lies in the XML parser configuration within ClassGraph. The library did not properly disable external entity processing and DTD (Document Type Definition) features when parsing XML documents. This oversight allowed malicious XML content with external entity references to be processed, enabling XXE attacks.

Secure XML parsing requires explicitly disabling features such as FEATURE_SECURE_PROCESSING, external general entities, external parameter entities, and DTD processing to prevent XXE vulnerabilities.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no user interaction or special privileges. An attacker can craft malicious XML content containing external entity declarations and submit it to an application using a vulnerable version of ClassGraph.

When the vulnerable application processes this malicious XML, the parser resolves the external entity references, which can point to local files (using file:// protocol) or external URLs (using http:// or https:// protocols). This allows attackers to:

1. Read sensitive local files such as /etc/passwd, application configuration files, or private keys
2. Perform SSRF attacks against internal services
3. Cause denial of service through billion laughs attacks or external resource exhaustion

The vulnerability mechanism involves crafted XML payloads with DOCTYPE declarations containing ENTITY definitions that reference external resources. When the vulnerable XML parser processes these payloads, it resolves the entity references, potentially exposing sensitive data to the attacker. For detailed technical implementation, refer to the GitHub Pull Request Discussion.

Detection Methods for CVE-2021-47621

Indicators of Compromise

• Unusual file access patterns in application logs, particularly attempts to read sensitive system files like /etc/passwd or application configuration files
• Outbound HTTP/HTTPS requests from the application to unexpected external destinations
• XML parsing errors or exceptions related to external entity resolution in application logs
• Network traffic containing XML payloads with DOCTYPE declarations and ENTITY definitions

Detection Strategies

• Implement dependency scanning tools to identify applications using ClassGraph versions prior to 4.8.112
• Monitor application logs for XML parsing exceptions or unusual file access attempts
• Deploy network intrusion detection systems (IDS) with signatures for XXE attack payloads
• Use Web Application Firewalls (WAF) with rules to detect and block malicious XML content containing external entity declarations

Monitoring Recommendations

• Enable verbose logging for XML parsing operations to capture potential exploitation attempts
• Monitor outbound network connections from application servers for SSRF indicators
• Implement file integrity monitoring on sensitive configuration files
• Set up alerts for unexpected file read operations by the application process

How to Mitigate CVE-2021-47621

Immediate Actions Required

• Upgrade ClassGraph to version 4.8.112 or later immediately
• Audit all applications in your environment that depend on ClassGraph library
• Review dependency trees to identify transitive dependencies on vulnerable ClassGraph versions
• Implement input validation to reject XML content with DOCTYPE declarations if not required by the application

Patch Information

The vulnerability was fixed in ClassGraph version 4.8.112. The security patch properly configures the XML parser to disable external entity processing and DTD features. The fix can be reviewed in the GitHub Commit Overview and the ClassGraph 4.8.112 Release.

For Corda Enterprise users, upgrade to version 4.8 or later as documented in the Corda 4.8 Release Notes.

Workarounds

• If immediate upgrade is not possible, implement WAF rules to filter incoming XML requests containing DOCTYPE or ENTITY declarations
• Configure network-level controls to restrict outbound connections from application servers
• Apply principle of least privilege to limit file system access for the application user
• Consider using an XML firewall or gateway to sanitize XML content before it reaches the application

# Maven dependency update example
# Update pom.xml to use patched ClassGraph version
# Change:
#   <dependency>
#     <groupId>io.github.classgraph</groupId>
#     <artifactId>classgraph</artifactId>
#     <version>4.8.111</version>
#   </dependency>
# To:
#   <dependency>
#     <groupId>io.github.classgraph</groupId>
#     <artifactId>classgraph</artifactId>
#     <version>4.8.112</version>
#   </dependency>