CVE-2025-27136: LocalS3 XXE Injection Vulnerability

CVE-2025-27136 Overview

CVE-2025-27136 is an XML External Entity (XXE) injection vulnerability in LocalS3, an Amazon S3 mock service used for testing and local development. Versions prior to 1.21 configure the XML parser to resolve external entities when processing the CreateBucketConfiguration document during bucket creation. Attackers can declare an external entity referencing an internal URL, causing the server to fetch that resource and embed its content in the parsed XML. This produces server-side request forgery (SSRF) and can leak sensitive information from internal services. Exploitation only requires the ability to send HTTP requests to the LocalS3 endpoint. The vulnerability is tracked as CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact
Unauthenticated attackers can trigger SSRF and read responses from internal network resources through the bucket creation endpoint.

Affected Products

LocalS3 (Robothy/local-s3) versions prior to 1.21
The local-s3-rest REST service component
XML processing paths using WstxInputFactory in LocalS3.java and XmlUtils.java

Discovery Timeline

2025-03-10 - CVE-2025-27136 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27136

Vulnerability Analysis

The LocalS3 REST service accepts an XML CreateBucketConfiguration payload when a client issues a PUT request to create a bucket. The service instantiates a Woodstox WstxInputFactory and wraps it in a Jackson XmlMapper without disabling Document Type Definitions (DTDs) or external entity resolution. When the parser encounters an entity declaration referencing an external URI, it dereferences the URI and substitutes the retrieved content into the parsed document tree.

The unsafe parsing occurs specifically in the location constraint handling path. Because the resolved entity value is included in the bucket configuration processing, the HTTP response body from the fetched URL is echoed back to the requester through the API response. This turns the parser into an SSRF primitive with response reflection.

Root Cause

The root cause is missing hardening on the XMLInputFactory instance. The factory properties SUPPORT_DTD and IS_SUPPORTING_EXTERNAL_ENTITIES default to enabled behavior in Woodstox, and neither was set to false before the mapper was constructed. Any XML deserialization routed through the shared xmlMapper inherits this unsafe configuration.

Attack Vector

An attacker sends a crafted CreateBucketConfiguration XML document containing a DOCTYPE declaration and an external entity that references an internal HTTP endpoint, such as a cloud metadata service or an internal admin API. The LocalS3 process resolves the entity server-side and includes the fetched content in its parsed representation, which is returned to the caller. No authentication is required.

The upstream fix disables DTD processing and external entity resolution in the XML input factory:

java

static {
    XMLInputFactory input = new WstxInputFactory();
    input.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, Boolean.FALSE);
    input.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
    input.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
    xmlMapper = new XmlMapper(new XmlFactory(input, new WstxOutputFactory()));
    xmlMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
    xmlMapper.registerModule(new Jdk8Module());
}

Source: Robothy/local-s3 patch commit d6ed756

Detection Methods for CVE-2025-27136

Indicators of Compromise

Inbound PUT requests to LocalS3 bucket endpoints containing <!DOCTYPE or <!ENTITY declarations in the request body
LocalS3 process initiating outbound HTTP requests to 127.0.0.1, 169.254.169.254, or other internal addresses shortly after bucket creation calls
Unusually large or structured response bodies from LocalS3 bucket creation endpoints that echo internal resource content

Detection Strategies

Inspect HTTP request bodies destined for LocalS3 for XML external entity syntax, including SYSTEM identifiers and parameter entities
Correlate LocalS3 request logs with outbound socket activity from the same process to flag SSRF-style callbacks
Alert on any LocalS3 outbound connections to link-local, loopback, or RFC1918 ranges that were not seen before the request

Monitoring Recommendations

Enable request body logging on any reverse proxy sitting in front of LocalS3 and retain payloads for XML pattern matching
Monitor DNS resolutions and egress connections from hosts running LocalS3, particularly to cloud metadata endpoints
Track the deployed LocalS3 version across development and CI environments to identify hosts still running builds prior to 1.21

How to Mitigate CVE-2025-27136

Immediate Actions Required

Upgrade LocalS3 to version 1.21 or later, which disables DTDs and external entity resolution in the XML parser
Restrict network exposure of LocalS3 instances to trusted development hosts only; do not expose them to untrusted networks
Block egress from LocalS3 processes to cloud metadata services and internal management interfaces

Patch Information

The fix is applied in commit d6ed756ceb30c1eb9d4263321ac683d734f8836f, which sets XMLInputFactory.SUPPORT_DTD and XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES to false in both local-s3-rest/src/main/java/com/robothy/s3/rest/LocalS3.java and local-s3-rest/src/main/java/com/robothy/s3/rest/utils/XmlUtils.java. See the GHSA-g6wm-2v64-wq36 advisory for the coordinated disclosure record.

Workarounds

If upgrading immediately is not feasible, place LocalS3 behind a reverse proxy that strips or rejects request bodies containing <!DOCTYPE or <!ENTITY
Run LocalS3 in an isolated network namespace or container with egress limited to loopback only
Apply the parser hardening from the patch commit as a local backport if a custom build is used

bash

# Verify installed LocalS3 version and upgrade
mvn dependency:tree | grep local-s3
# Bump the dependency to 1.21 or later in your build file, then rebuild
# For containerized deployments, pin the image tag to a fixed version >= 1.21
docker pull robothy/local-s3:1.21