CVE-2025-52888: Allure 2 xunit-xml-plugin XXE Vulnerability

CVE-2025-52888 Overview

CVE-2025-52888 is a critical XML External Entity (XXE) vulnerability affecting Allure 2, a widely-used multi-language test reporting tool. The vulnerability exists in the xunit-xml-plugin component used by Allure 2 versions prior to 2.34.1. The plugin fails to securely configure the XML parser (DocumentBuilderFactory) and allows external entity expansion when processing test result .xml files. This flaw enables attackers to read arbitrary files from the file system and potentially trigger Server-Side Request Forgery (SSRF) attacks.

Critical Impact

Attackers can exploit this XXE vulnerability to exfiltrate sensitive files from the server's file system, including configuration files, credentials, and private keys. Additionally, SSRF exploitation could allow attackers to probe internal network services and potentially pivot to further attacks.

Affected Products

• Allure 2 (allure-framework/allure2) versions prior to 2.34.1
• xunit-xml-plugin component in Allure 2

Discovery Timeline

• 2025-06-24 - CVE CVE-2025-52888 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-52888

Vulnerability Analysis

This XXE vulnerability (CWE-611) arises from insecure XML parsing configuration in the xunit-xml-plugin. When Allure 2 processes test result XML files, the underlying DocumentBuilderFactory is not configured to disable external entity processing. XML parsers that allow external entities can be abused to reference external resources, including local files via file:// protocol or remote resources via HTTP/HTTPS.

The vulnerability is accessible over the network without requiring authentication or user interaction, making it particularly dangerous in automated CI/CD environments where Allure is commonly deployed to aggregate test results. An attacker who can supply a malicious XML test result file can exploit this weakness to extract sensitive data from the server.

Root Cause

The root cause is the failure to disable external entity processing in the DocumentBuilderFactory configuration. By default, Java XML parsers may allow Document Type Definitions (DTDs) and external entity references. Secure configuration requires explicitly disabling features like http://xml.org/sax/features/external-general-entities, http://xml.org/sax/features/external-parameter-entities, and http://apache.org/xml/features/nonvalidating/load-external-dtd.

Attack Vector

The attack vector involves crafting a malicious XML file that contains external entity declarations. When this file is processed by Allure 2 as a test result, the XML parser resolves the external entities, allowing the attacker to:

1. Read Local Files: Using file:// protocol references to access sensitive files like /etc/passwd, application configuration files, or SSH keys
2. Trigger SSRF: Using HTTP/HTTPS URLs to make the server send requests to internal services or external attacker-controlled servers

The vulnerability is exploitable over the network by any user who can submit or upload test result XML files to be processed by Allure 2. No authentication is required to exploit this flaw.

For technical details on the vulnerability and the applied fix, refer to the GitHub Security Advisory and the commit implementing the patch.

Detection Methods for CVE-2025-52888

Indicators of Compromise

• Unusual file access patterns in logs, particularly access to sensitive system files like /etc/passwd, /etc/shadow, or application configuration files
• Outbound HTTP/HTTPS connections from the Allure service to unexpected internal or external hosts
• XML files in test result directories containing DTD declarations or ENTITY references
• Error logs indicating XML parsing failures with external resource references

Detection Strategies

• Monitor file system access from the Allure process for reads of sensitive system files outside expected directories
• Implement network monitoring to detect SSRF-style outbound connections from the test reporting infrastructure
• Scan incoming XML test result files for suspicious DTD declarations, ENTITY definitions, or external resource references before processing
• Review Allure application logs for XML parsing errors that may indicate exploitation attempts

Monitoring Recommendations

• Enable verbose logging for the Allure service and XML parsing operations
• Deploy file integrity monitoring (FIM) on sensitive system files and directories
• Implement network segmentation to limit the blast radius of potential SSRF exploitation
• Use SentinelOne's behavioral AI to detect anomalous file access and network activity from the Allure process

How to Mitigate CVE-2025-52888

Immediate Actions Required

• Upgrade Allure 2 to version 2.34.1 or later immediately
• Audit existing test result XML files for suspicious external entity declarations
• Restrict network access from Allure servers to limit SSRF impact
• Review access logs for signs of prior exploitation attempts

Patch Information

The vulnerability has been addressed in Allure 2 version 2.34.1. The fix implements secure XML parser configuration by disabling external entity processing in the DocumentBuilderFactory. Organizations should update to this version or later as soon as possible.

For detailed patch information, see the GitHub commit and the GitHub Security Advisory.

Workarounds

• Implement input validation on XML files before they are processed by Allure, stripping or rejecting files with DTD declarations or external entity references
• Deploy Allure in a sandboxed environment with restricted file system access and no outbound network connectivity
• Use a Web Application Firewall (WAF) to filter incoming XML content for XXE attack patterns
• Run the Allure service under a restricted user account with minimal file system permissions

# Configuration example - Restrict Allure service permissions
# Create a dedicated user for Allure with minimal privileges
useradd -r -s /bin/false allure-service

# Set restrictive file permissions on Allure directories
chown -R allure-service:allure-service /opt/allure
chmod -R 750 /opt/allure

# Limit network access using iptables (example for blocking outbound)
iptables -A OUTPUT -m owner --uid-owner allure-service -j DROP