PowSyBl Core XML Reader erlaubt XXE und SSRF

The SSRF/XXE vulnerability in powsybl-commons presents a significant risk to applications utilizing the library. An attacker can exploit this flaw by crafting malicious XML input that triggers the vulnerable parsing logic. Successful exploitation allows the attacker to initiate requests to internal resources, potentially exposing sensitive data or gaining unauthorized access to system files. The ability to read arbitrary files could reveal configuration details, API keys, or other confidential information. In a multi-tenant environment, this vulnerability could allow an attacker to compromise other tenants by leveraging their XML submissions.

Applications utilizing com.powsybl:powsybl-commons versions 6.7.1 or earlier are at risk. This includes Java-based applications, particularly those that process XML data from untrusted sources, such as multi-tenant applications or those integrating with external systems. Legacy systems that have not been regularly updated are also at increased risk.

• java / server:

find / -name "powsybl-commons-*.jar" -print0 | xargs -0 java -jar <jar_file> -Djava.security.xml.external.entities=null -Djava.security.xml.external.dtd=null

• linux / server:

journalctl -u <application_name> | grep -i "xml parsing" 

• generic web:

curl -I <application_url>/xml-endpoint | grep -i "Server: Powsybl"

1. 2025-06-19Disclosure

   disclosure

1. Reserviert2025-05-05
2. Veröffentlicht2025-06-19
3. Geändert2025-06-20
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-47293 is to upgrade to powsybl-commons version 6.7.2 or later, which contains the necessary fixes. If upgrading is not immediately feasible, consider implementing input validation and sanitization on all XML data received from untrusted sources. Specifically, restrict the allowed XML namespaces and elements to prevent attackers from injecting malicious code. Web Application Firewalls (WAFs) configured to detect and block XXE attacks can provide an additional layer of defense. Monitor application logs for unusual outbound requests originating from the com.powsybl.commons.xml.XmlReader class.