CVE-2024-31573: XMLUnit for Java RCE Vulnerability

CVE-2024-31573 Overview

CVE-2024-31573 is a code execution vulnerability in XMLUnit for Java versions prior to 2.10.0. In the default configuration, the library enables XSLT extension functions, which could allow attackers to execute arbitrary code through untrusted stylesheets used for XSLT transformations. This vulnerability stems from improper resource transfer between spheres (CWE-669), where potentially dangerous XSLT capabilities are exposed without adequate restrictions.

Critical Impact

Applications using XMLUnit for Java with default settings may be vulnerable to code execution if they process untrusted XSLT stylesheets, potentially allowing attackers to compromise the application and underlying system.

Affected Products

• XMLUnit for Java versions before 2.10.0

Discovery Timeline

• 2025-10-17 - CVE CVE-2024-31573 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2024-31573

Vulnerability Analysis

The vulnerability resides in XMLUnit for Java's handling of XSLT transformations. XSLT (Extensible Stylesheet Language Transformations) is a powerful language for transforming XML documents, but it also supports extension functions that can invoke Java methods directly. When XMLUnit processes XSLT stylesheets with extension functions enabled by default, an attacker who can supply a malicious stylesheet gains the ability to execute arbitrary Java code within the context of the application.

This type of vulnerability is particularly dangerous in scenarios where applications accept XML/XSLT content from untrusted sources, such as user uploads, API inputs, or external integrations. The local attack vector indicates that exploitation requires some level of local access or the ability to influence local files/inputs that the vulnerable application processes.

Root Cause

The root cause is classified under CWE-669 (Incorrect Resource Transfer Between Spheres). XMLUnit for Java, in versions before 2.10.0, enables XSLT extension functions by default. These extension functions provide a bridge between XSLT processing and Java code execution, effectively transferring control from the XML processing sphere to the Java execution sphere without proper security boundaries. The permissive default configuration fails to restrict potentially dangerous capabilities that should be explicitly opt-in rather than opt-out.

Attack Vector

Exploitation requires local access to supply or influence XSLT stylesheets processed by a vulnerable XMLUnit instance. An attacker must craft a malicious XSLT stylesheet containing extension function calls that invoke arbitrary Java methods. When the application uses XMLUnit to perform an XSLT transformation with this stylesheet, the embedded extension functions execute, allowing the attacker to run arbitrary code.

The attack scenario typically involves an application that accepts XSLT stylesheets from users or external sources for XML transformation purposes. Without proper validation or with XMLUnit's insecure defaults, these stylesheets become a vector for code execution.

For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory and the GitHub Issue Discussion.

Detection Methods for CVE-2024-31573

Indicators of Compromise

• Unexpected Java method invocations during XML/XSLT processing operations
• Anomalous system calls or process spawning originating from Java applications using XMLUnit
• XSLT stylesheets containing extension function declarations or namespace bindings to Java classes

Detection Strategies

• Review application dependencies for XMLUnit for Java versions below 2.10.0
• Implement input validation to detect XSLT stylesheets containing extension function declarations
• Monitor Java applications for unexpected code execution patterns during XML processing
• Use Software Composition Analysis (SCA) tools to identify vulnerable XMLUnit versions

Monitoring Recommendations

• Enable detailed logging for XSLT transformation operations within applications
• Monitor file system access and network connections from applications performing XML transformations
• Implement application-level monitoring to detect anomalous behavior during XML processing workflows

How to Mitigate CVE-2024-31573

Immediate Actions Required

• Upgrade XMLUnit for Java to version 2.10.0 or later immediately
• Audit all applications using XMLUnit for Java to identify vulnerable instances
• Restrict XSLT stylesheet sources to trusted origins only
• Implement input validation to sanitize or reject untrusted XSLT content

Patch Information

The vulnerability has been addressed in XMLUnit for Java version 2.10.0. The fix disables XSLT extension functions by default, ensuring that potentially dangerous capabilities must be explicitly enabled. Review the GitHub Commit Update for implementation details.

Workarounds

• If immediate upgrade is not possible, configure XMLUnit to explicitly disable XSLT extension functions
• Implement application-level controls to reject XSLT stylesheets containing extension function declarations
• Isolate XML processing operations in sandboxed environments with restricted permissions
• Use allowlisting to permit only known, trusted XSLT stylesheets

# Maven dependency update example
# Update pom.xml to use patched version
mvn versions:use-latest-versions -Dincludes=org.xmlunit:*
# Verify the updated version
mvn dependency:tree | grep xmlunit