CVE-2024-46455: Unstructured XXE Vulnerability

CVE-2024-46455 Overview

CVE-2024-46455 is a critical XML External Entity (XXE) vulnerability discovered in the Unstructured Python library, specifically affecting version 0.14.2 and earlier releases. The vulnerability exists in the XMLParser component, which fails to properly restrict XML external entity processing. This weakness allows attackers to craft malicious XML input that can lead to disclosure of confidential data, denial of service, server-side request forgery, and other system impacts.

Critical Impact

Attackers can exploit this XXE vulnerability to read arbitrary files from the server, perform server-side request forgery (SSRF) attacks, and potentially achieve remote code execution depending on the system configuration and available protocols.

Affected Products

• Unstructured Python library version 0.14.2
• Unstructured Python library versions prior to 0.14.2

Discovery Timeline

• 2024-12-09 - CVE-2024-46455 published to NVD
• 2024-12-12 - Last updated in NVD database

Technical Details for CVE-2024-46455

Vulnerability Analysis

This vulnerability is classified under CWE-611 (Improper Restriction of XML External Entity Reference). The Unstructured library, which is designed for preprocessing and parsing various document formats including XML, contains an XMLParser component that does not properly sanitize or restrict external entity references within XML documents.

When the XMLParser processes user-supplied XML content without disabling external entity resolution, an attacker can define external entities that reference local files on the server filesystem, internal network resources, or external URLs. This enables a range of attacks including arbitrary file read, internal network reconnaissance, and potential remote code execution if combined with vulnerable protocol handlers.

The network attack vector means exploitation can occur remotely without requiring prior authentication or user interaction, significantly increasing the risk profile of this vulnerability.

Root Cause

The root cause of CVE-2024-46455 lies in the XMLParser component's failure to disable external entity processing by default. XML parsers in Python (such as those based on lxml or xml.etree) must be explicitly configured to prevent XXE attacks by disabling features like DTD processing, external entity expansion, and external parameter entities. The affected versions of the Unstructured library do not implement these security controls, leaving the parser in a vulnerable default state.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Submitting a malicious XML document containing external entity declarations to an application using the vulnerable Unstructured library
2. The XMLParser processes the document without sanitizing external entity references
3. The parser resolves the external entities, potentially fetching local files (using file:// protocol) or making HTTP requests to internal/external resources
4. Sensitive data is exfiltrated through the entity resolution mechanism or via out-of-band channels

The vulnerability can manifest in applications that accept XML input for document processing, data extraction, or format conversion using the Unstructured library. Typical attack payloads involve defining entities that reference sensitive files such as /etc/passwd, application configuration files, or cloud metadata endpoints.

Detection Methods for CVE-2024-46455

Indicators of Compromise

• Unusual XML documents containing <!DOCTYPE> declarations with <!ENTITY> definitions referencing external resources
• Log entries showing file access attempts to sensitive system files (/etc/passwd, /etc/shadow, application config files)
• Outbound network connections from XML processing services to unexpected internal or external hosts
• Error messages revealing file paths or internal server information during XML parsing operations

Detection Strategies

• Implement input validation rules to detect and block XML documents containing DTD declarations or entity definitions
• Monitor application logs for XML parsing errors that may indicate exploitation attempts
• Deploy web application firewalls (WAF) with XXE detection signatures
• Use runtime application self-protection (RASP) solutions to detect and block XXE exploitation attempts
• Review code for usage of the Unstructured library's XMLParser component and audit for proper security configurations

Monitoring Recommendations

• Enable detailed logging for all XML parsing operations in applications using the Unstructured library
• Set up alerts for access to sensitive system files from web application processes
• Monitor network traffic for unusual outbound connections from servers processing XML content
• Implement file integrity monitoring on critical configuration files that may be targeted by XXE attacks

How to Mitigate CVE-2024-46455

Immediate Actions Required

• Audit your applications to identify any usage of the Unstructured library version 0.14.2 or earlier
• Upgrade the Unstructured library to the latest available version that addresses this vulnerability
• Review and restrict network access for systems running the vulnerable library to limit SSRF impact
• Implement input validation to reject XML documents containing DTD declarations or external entity references

Patch Information

Organizations using the affected Unstructured library should upgrade to a patched version. Check the GitHub Unstructured Repository for the latest releases and security advisories. Additional technical analysis is available at the Binary Soul CVE Analysis.

Workarounds

• If upgrading is not immediately possible, wrap the XMLParser with a custom parser that explicitly disables external entity processing
• Configure XML parsing libraries to disable DTD processing, external entities, and external parameter entities
• Implement strict input validation to sanitize or reject XML documents before processing
• Use application-level firewalls to filter malicious XML payloads at the network perimeter

# Example: Check installed Unstructured version
pip show unstructured | grep Version

# Upgrade to latest version
pip install --upgrade unstructured

# Alternatively, pin to a specific patched version
pip install unstructured>=0.15.0