CVE-2025-12921 Overview
CVE-2025-12921 is an XML injection vulnerability in OpenClinica Community Edition versions up to 3.12.2 and 3.13. The flaw resides in the /ImportCRFData?action=confirm endpoint of the CRF Data Import component. Attackers can manipulate the xml_file argument to inject malicious XML content. The issue is classified under CWE-74 and CWE-91. Exploitation requires network access and low privileges, with no user interaction required. The exploit details have been publicly disclosed, and the vendor did not respond to early disclosure attempts.
Critical Impact
Authenticated attackers can remotely inject XML payloads through the CRF Data Import functionality, potentially leading to data exposure through XML External Entity (XXE) processing.
Affected Products
- OpenClinica Community Edition 3.12.2
- OpenClinica Community Edition 3.13
- CRF Data Import component (/ImportCRFData?action=confirm)
Discovery Timeline
- 2025-11-10 - CVE-2025-12921 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2025-12921
Vulnerability Analysis
The vulnerability affects the CRF (Case Report Form) Data Import feature of OpenClinica Community Edition. OpenClinica is an open-source clinical trial software platform used in clinical research environments. The /ImportCRFData?action=confirm endpoint accepts XML data through the xml_file parameter without sufficient validation or sanitization. An authenticated attacker with low-level privileges can submit crafted XML content that the application's parser processes unsafely.
Public references identify the issue as an XML External Entity (XXE) variant. The application's XML parser does not disable external entity resolution or external DTD processing. This permits attackers to embed entity declarations that reference local files or external resources during XML parsing.
Root Cause
The root cause is improper neutralization of data within XML input (CWE-91). The CRF Data Import handler deserializes user-supplied XML using a parser configured with permissive defaults. The application fails to disable DOCTYPE declarations or external entity expansion before processing the xml_file parameter.
Attack Vector
An authenticated user submits a POST request to /ImportCRFData?action=confirm with the xml_file parameter containing a malicious XML payload. The payload includes external entity declarations referencing local files, internal network endpoints, or attacker-controlled servers. When the server parses the document, the resolver fetches the referenced content and includes it in subsequent processing or error output.
For verified proof-of-concept details, see the GitHub Security Findings advisory and the VulDB entry #331641.
Detection Methods for CVE-2025-12921
Indicators of Compromise
- POST requests to /ImportCRFData?action=confirm containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords in the xml_file parameter.
- Outbound DNS or HTTP requests from the OpenClinica server to unexpected external hosts during or shortly after CRF import operations.
- Application logs showing XML parser errors referencing entity resolution or file URI schemes such as file:// or http://.
Detection Strategies
- Inspect web application logs for CRF Data Import requests containing inline DTDs or entity declarations.
- Deploy WAF rules that flag XML payloads containing SYSTEM identifiers or file:// URI references submitted to OpenClinica endpoints.
- Correlate authenticated user import activity with outbound network connections originating from the application server.
Monitoring Recommendations
- Enable verbose logging on the OpenClinica application server and forward logs to a centralized analytics platform for review.
- Monitor egress traffic from servers hosting OpenClinica for connections to non-clinical-trial domains.
- Track failed and successful CRF import operations per user account to identify unusual import volumes or patterns.
How to Mitigate CVE-2025-12921
Immediate Actions Required
- Restrict access to the /ImportCRFData endpoint to trusted administrators and known IP ranges through network-level controls.
- Audit existing OpenClinica user accounts and revoke import privileges from accounts that do not require them.
- Review historical web server and application logs for prior exploitation attempts targeting the xml_file parameter.
Patch Information
No vendor patch is available. According to the disclosure, the vendor was contacted early about this issue but did not respond. Operators of OpenClinica Community Edition 3.12.2 and 3.13 should evaluate migrating to a supported clinical trial platform or applying compensating controls. Track updates via the VulDB advisory.
Workarounds
- Place the OpenClinica application behind a reverse proxy or WAF that blocks requests containing <!DOCTYPE or <!ENTITY declarations in the xml_file parameter.
- Disable network egress from the OpenClinica server to prevent external entity resolution from reaching attacker-controlled infrastructure.
- Limit CRF Data Import functionality to an isolated administrative network segment until a vendor fix is released.
- If source modifications are feasible, reconfigure the XML parser to disable DOCTYPE, external general entities, and external parameter entities.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
