CVE-2025-4641: WebDriverManager XXE Vulnerability

CVE-2025-4641 Overview

CVE-2025-4641 is an XML External Entity (XXE) vulnerability affecting bonigarcia WebDriverManager, a popular Java library used for managing WebDriver binaries in automated browser testing environments. The vulnerability exists in the XML parsing components of the library, specifically within src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java, allowing attackers to exploit improper restriction of XML external entity references.

This XXE vulnerability enables attackers to perform Data Serialization External Entities Blowup attacks, potentially leading to sensitive data exposure, server-side request forgery (SSRF), and denial of service conditions through entity expansion attacks (also known as "Billion Laughs" attacks).

Critical Impact

This vulnerability allows network-based attackers to exploit XML parsing weaknesses without authentication, potentially exposing confidential data, enabling lateral movement through SSRF, and causing service disruption via entity expansion attacks.

Affected Products

• bonigarcia WebDriverManager versions 1.0.0 through 6.0.1
• Applications on Windows, MacOS, and Linux using vulnerable WebDriverManager versions
• Java applications utilizing WebDriverManager XML parsing components

Discovery Timeline

• 2025-05-14 - CVE CVE-2025-4641 published to NVD
• 2025-05-16 - Last updated in NVD database

Technical Details for CVE-2025-4641

Vulnerability Analysis

The vulnerability stems from improper handling of XML external entity references in WebDriverManager's XML parsing functionality. When the library processes XML data, it fails to properly restrict or disable external entity resolution, creating an attack surface for XXE-based exploitation.

XXE vulnerabilities occur when XML parsers are configured to process external entity declarations within XML documents. An attacker can craft malicious XML content containing external entity references that, when parsed by the vulnerable application, can trigger various malicious behaviors including file disclosure, SSRF attacks, or resource exhaustion through recursive entity expansion.

The affected code path resides in the WebDriverManager.java file within the XML parsing components modules. When WebDriverManager processes configuration or metadata XML files, the parser may inadvertently process attacker-controlled external entities if malicious XML content is introduced into the parsing pipeline.

Root Cause

The root cause is the lack of secure XML parser configuration in the WebDriverManager library. The XML parser does not disable Document Type Definition (DTD) processing or external entity resolution, which are security best practices for preventing XXE attacks (CWE-611: Improper Restriction of XML External Entity Reference).

Secure XML parsing requires explicitly disabling features such as:

• External DTD loading
• External general entities
• External parameter entities
• DTD processing entirely when not required

The absence of these security configurations allows attackers to inject malicious entity declarations that the parser will resolve during document processing.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by supplying crafted XML content to the WebDriverManager library through any input vector that reaches the vulnerable XML parsing functionality.

The exploitation typically involves crafting XML documents with malicious external entity declarations. When the vulnerable parser processes this content, it attempts to resolve the entities, which can lead to:

1. Information Disclosure: Entity references pointing to local file paths can exfiltrate sensitive files from the server
2. Server-Side Request Forgery (SSRF): Entity references to internal network resources can probe internal infrastructure
3. Denial of Service: Recursive entity expansion (Entity Blowup/Billion Laughs) can consume excessive memory and CPU resources

The vulnerability affects systems running on Windows, MacOS, and Linux platforms, making it a cross-platform security concern for any application utilizing the affected WebDriverManager versions in their test automation infrastructure.

Detection Methods for CVE-2025-4641

Indicators of Compromise

• Unusual XML parsing errors or exceptions in application logs related to WebDriverManager operations
• Unexpected outbound network connections originating from XML parsing processes
• Abnormal memory consumption spikes during XML document processing
• Attempted file access to sensitive system files from Java processes running WebDriverManager

Detection Strategies

• Monitor application logs for XML parsing exceptions containing external entity references or DTD processing errors
• Implement network monitoring to detect unexpected outbound connections from application servers to internal resources
• Deploy Web Application Firewall (WAF) rules to inspect incoming XML payloads for external entity declarations
• Utilize Java security managers to alert on unexpected file system or network access during XML parsing operations

Monitoring Recommendations

• Configure alerting for memory exhaustion patterns that may indicate entity expansion attacks
• Audit WebDriverManager version usage across all development, testing, and CI/CD environments
• Implement logging of all XML input sources processed by the application to aid forensic analysis
• Monitor for unusual CPU utilization patterns associated with Java XML parsing threads

How to Mitigate CVE-2025-4641

Immediate Actions Required

• Upgrade WebDriverManager to version 6.0.2 or later immediately across all environments
• Audit all applications and CI/CD pipelines for vulnerable WebDriverManager dependencies
• Review software bill of materials (SBOM) to identify all instances of the vulnerable library
• Implement network segmentation to limit the impact of potential SSRF exploitation

Patch Information

The vulnerability has been addressed in WebDriverManager version 6.0.2. The fix involves properly configuring XML parsers to disable external entity processing and DTD resolution. Details of the security fix can be found in the GitHub Pull Request #1458.

Organizations should update their Maven or Gradle dependencies to reference version 6.0.2 or later:

For Maven:

<dependency>
    <groupId>io.github.bonigarcia</groupId>
    <artifactId>webdrivermanager</artifactId>
    <version>6.0.2</version>
</dependency>

For Gradle:

implementation 'io.github.bonigarcia:webdrivermanager:6.0.2'

Workarounds

• If immediate upgrade is not possible, implement input validation to sanitize XML content before processing
• Configure network egress filtering to prevent SSRF exploitation through outbound connection restrictions
• Implement resource limits on XML parsing operations to mitigate entity expansion denial of service attacks
• Consider using XML parsing libraries with secure defaults or implement wrapper functions that enforce secure parser configuration

# Verify current WebDriverManager version in Maven projects
mvn dependency:tree | grep webdrivermanager

# Update to patched version
mvn versions:use-latest-versions -Dincludes=io.github.bonigarcia:webdrivermanager