CVE-2022-0265: Hazelcast XXE Vulnerability in Version 5.1

CVE-2022-0265 Overview

CVE-2022-0265 is a critical XML External Entity (XXE) vulnerability discovered in Hazelcast, an open-source in-memory data grid platform. The vulnerability exists in Hazelcast version 5.1-BETA-1, where improper restriction of XML external entity references allows attackers to exploit the XML parsing functionality. XXE vulnerabilities enable attackers to interfere with an application's processing of XML data, potentially leading to sensitive data disclosure, server-side request forgery, or remote code execution.

Critical Impact

This XXE vulnerability allows unauthenticated remote attackers to potentially access sensitive files, perform server-side request forgery (SSRF), and in some configurations achieve remote code execution through malicious XML payloads.

Affected Products

• Hazelcast 5.1-BETA-1
• Hazelcast IMDG configurations utilizing XML parsing

Discovery Timeline

• 2022-03-03 - CVE-2022-0265 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0265

Vulnerability Analysis

This vulnerability stems from insufficient protection against XML External Entity (XXE) attacks in Hazelcast's XML configuration parsing components. The affected code in AbstractXmlConfigRootTagRecognizer.java processes XML input without proper security controls to disable external entity resolution. When an application parses XML input containing references to external entities, an attacker can craft malicious XML documents that force the parser to retrieve external resources, disclose local file contents, or perform unauthorized network requests.

The vulnerability is particularly concerning in distributed computing environments where Hazelcast is commonly deployed, as it could allow attackers to pivot across internal networks or exfiltrate sensitive configuration data stored on cluster nodes.

Root Cause

The root cause of CVE-2022-0265 lies in the SAXParserFactory configuration used within Hazelcast's XML configuration handling. The XML parser was not configured with XXE protection features enabled, allowing the parser to process external entity declarations and resolve external references. The fix introduces proper security controls through the XmlUtil utility class to disable dangerous XML features such as external general entities, external parameter entities, and DOCTYPE declarations.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker can exploit this vulnerability by submitting a specially crafted XML document to any Hazelcast component that processes XML configuration data. The malicious XML payload would contain external entity declarations that reference sensitive local files (such as /etc/passwd on Linux systems) or internal network resources. When the vulnerable parser processes this XML, it resolves the external entities and potentially returns their contents to the attacker.

// Security patch adding XXE protection
// Source: https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748
 
import com.hazelcast.config.ConfigRecognizer;
import com.hazelcast.config.ConfigStream;
+import com.hazelcast.internal.util.XmlUtil;
import com.hazelcast.logging.ILogger;
import com.hazelcast.logging.Logger;
import org.xml.sax.Attributes;

The patch introduces the XmlUtil helper class to enable XXE protection in the SAXParserFactory, ensuring external entity processing is disabled before parsing any XML content.

Detection Methods for CVE-2022-0265

Indicators of Compromise

• Unusual outbound network connections from Hazelcast nodes to external or internal systems
• XML payloads containing DOCTYPE declarations with ENTITY references in application logs
• Unexpected file access patterns on Hazelcast cluster nodes
• Error messages related to XML parsing failures with external entity references

Detection Strategies

• Monitor network traffic for suspicious XML payloads containing external entity declarations
• Implement web application firewall (WAF) rules to detect and block XXE attack patterns
• Review application logs for XML parsing errors or unusual configuration loading attempts
• Use SentinelOne Singularity to detect anomalous process behavior and file access on Hazelcast nodes

Monitoring Recommendations

• Enable verbose logging for Hazelcast XML configuration parsing components
• Monitor for SSRF indicators such as unexpected internal network reconnaissance
• Track file read operations for sensitive files like /etc/passwd, configuration files, and credentials
• Implement egress filtering to prevent data exfiltration through XXE-based SSRF

How to Mitigate CVE-2022-0265

Immediate Actions Required

• Upgrade Hazelcast to a patched version that includes the XXE protection fix (commit 4d6b666cd0291abd618c3b95cdbb51aa4208e748)
• Review and restrict network access to Hazelcast management interfaces
• Implement input validation for any XML data processed by the application
• Consider using JSON configuration format as an alternative to XML where possible

Patch Information

Hazelcast has addressed this vulnerability in subsequent releases. The security fix is available in the GitHub commit which adds a helper method to XmlUtil to enable XXE protection in the SAXParserFactory. Organizations should update to a version that includes this fix. Additional details about the vulnerability disclosure can be found on the Huntr bounty page.

Workarounds

• Configure XML parsers to disable external entity processing at the application level
• Implement network segmentation to limit the impact of potential SSRF attacks
• Use a security-hardened XML parser configuration with features like DTD processing disabled
• Deploy a WAF with XXE detection capabilities in front of Hazelcast endpoints

# Example SAXParserFactory hardening configuration
# Disable external entities and DTD processing in Java applications
# Add these JVM options or configure programmatically:
-Djavax.xml.parsers.SAXParserFactory=com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl
# Configure parser with secure processing features enabled