CVE-2023-4218: Eclipse IDE XXE Vulnerability

CVE-2023-4218 Overview

In Eclipse IDE versions prior to 2023-09 (4.29), certain files with XML content are parsed in a manner vulnerable to XML External Entity (XXE) attacks. This vulnerability can be triggered when a user opens a malicious project or updates an existing open project containing a vulnerable file, such as when reviewing a foreign repository or patch.

Critical Impact

Attackers can exploit XXE parsing flaws to read arbitrary local files, potentially exposing sensitive configuration data, credentials, or source code from the developer's workstation.

Affected Products

• Eclipse Eclipse IDE (versions < 2023-09 / 4.29)
• Eclipse org.eclipse.core.runtime
• Eclipse PDE (Plugin Development Environment)

Discovery Timeline

• November 9, 2023 - CVE-2023-4218 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-4218

Vulnerability Analysis

CVE-2023-4218 represents a classic XML External Entity (XXE) injection vulnerability (CWE-611) affecting multiple components within the Eclipse IDE ecosystem. The vulnerability arises from insecure XML parsing implementations across various Eclipse platform modules including CDT (C/C++ Development Tooling), JDT (Java Development Tools), and PDE (Plugin Development Environment).

The attack requires local access with low privileges and user interaction—specifically, the victim must open a malicious project or update a project containing crafted XML files. When successful, this vulnerability enables unauthorized read access to confidential files on the affected system. The nature of the XXE flaw means attackers could potentially exfiltrate sensitive data such as SSH keys, environment configuration files, or proprietary source code from developer workstations.

Root Cause

The root cause of this vulnerability stems from the use of default DocumentBuilderFactory and TransformerFactory configurations without proper XXE protections. Multiple Eclipse components were instantiating XML parsers directly using DocumentBuilderFactory.newInstance() without disabling external entity processing or DTD loading. The Eclipse security team addressed this by introducing XmlProcessorFactory from org.eclipse.core.internal.runtime which provides secure-by-default XML parsing configurations.

Attack Vector

The attack vector requires a developer to interact with malicious project files. An attacker could craft a malicious Eclipse project containing XML configuration files (such as .project, .classpath, plugin manifests, or JUnit test result files) with embedded XXE payloads. When the victim:

1. Opens or imports the malicious project
2. Reviews a pull request or patch containing crafted XML files
3. Updates an existing project with compromised XML content

The vulnerable XML parsers process the external entity declarations, allowing the attacker to read arbitrary files from the victim's file system or potentially trigger server-side request forgery (SSRF) attacks.

// Security patch example showing migration to secure XML processing
// Source: https://github.com/eclipse-jdt/eclipse.jdt.core/commit/38dd2a878f45cdb3d8d52090f1d6d1b532fd4c4d

import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;

+import org.eclipse.core.internal.runtime.XmlProcessorFactory;
import org.eclipse.core.resources.IFile;
import org.eclipse.core.resources.IProject;
import org.eclipse.core.resources.IResource;

Source: GitHub JDT Core Commit Change

// Removal of direct TransformerFactory instantiation
// Source: https://github.com/eclipse-jdt/eclipse.jdt.ui/commit/13675b1f8a74f47de4da89ed0ded6af7c21dfbec

import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerConfigurationException;
import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
import javax.xml.transform.TransformerFactoryConfigurationError;
import javax.xml.transform.sax.SAXSource;
import javax.xml.transform.stream.StreamResult;

Source: GitHub JDT UI Commit Update

Detection Methods for CVE-2023-4218

Indicators of Compromise

• Unexpected outbound network connections from Eclipse IDE processes attempting to fetch external DTDs or entities
• Eclipse workspace logs showing errors related to external entity resolution or DTD processing failures
• Presence of suspicious XML files in imported projects containing <!DOCTYPE> declarations with external entity references
• File access attempts to sensitive system files (e.g., /etc/passwd, ~/.ssh/id_rsa, Windows credential stores) from Eclipse processes

Detection Strategies

• Monitor Eclipse process behavior for unusual file read operations outside the workspace directory
• Implement file integrity monitoring on Eclipse workspace directories to detect introduction of malicious XML files
• Configure network monitoring to detect external entity fetch attempts (DNS lookups or HTTP requests to suspicious domains during XML parsing)
• Review Eclipse error logs for XML parsing exceptions that may indicate blocked XXE exploitation attempts

Monitoring Recommendations

• Enable verbose logging for XML parsing operations in Eclipse to capture potential exploitation attempts
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious file access patterns from Java/Eclipse processes
• Implement code review processes to scan incoming project files and pull requests for XXE payloads before opening in Eclipse

How to Mitigate CVE-2023-4218

Immediate Actions Required

• Upgrade Eclipse IDE to version 2023-09 (4.29) or later immediately
• Review and update any plugins or extensions that may independently process XML files
• Audit recently opened projects from external sources for suspicious XML content
• Consider using network segmentation to limit impact of potential data exfiltration

Patch Information

Eclipse has released comprehensive patches across multiple platform components. The fixes migrate XML processing to use the secure XmlProcessorFactory class from org.eclipse.core.internal.runtime which provides XXE-safe default configurations. Key patches include:

• GitHub CDT Commit Update - CDT Autotools core security fix
• GitHub JDT Core Commit Change - JDT APT core XML parsing refactor
• GitHub JDT UI Commit Update - JUnit model and template set fixes
• GitHub Platform Pull Request #761 - Platform-level security improvements

The full vulnerability report is tracked at GitLab Vulnerability Report #8.

Workarounds

• Avoid opening projects or importing code from untrusted external sources until patched
• Use isolated virtual machines or containers for reviewing untrusted repositories
• Manually inspect XML files in projects from external sources before opening them in Eclipse
• Configure firewall rules to block outbound connections from Eclipse processes to unknown destinations

# Configuration example - Verify Eclipse version meets minimum requirements
eclipse -version
# Should show: Eclipse IDE 2023-09 (4.29) or later

# Check for outdated plugins that may still contain vulnerable XML parsing
eclipse -application org.eclipse.equinox.p2.director \
  -repository https://download.eclipse.org/releases/2023-09 \
  -list