CVE-2025-47293: SSRF in powsybl-commons

The SSRF vulnerability in powsybl-commons arises from improper handling of XML input, leading to an XML External Entity (XXE) attack. An attacker can craft malicious XML payloads that instruct the application to make requests to internal or external resources. This can be leveraged to read arbitrary files on the server, potentially exposing sensitive data such as configuration files, credentials, or other confidential information. The impact is amplified in multi-tenant environments where multiple users share the same application instance, as a successful attack could compromise the entire system. The ability to read sensitive files represents a significant security risk, potentially leading to data breaches and system compromise.

1. Reserved2025-05-05
2. Published2025-06-19
3. Modified2025-06-20
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-47293 is to upgrade to powsybl-commons version 6.7.2 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing input validation and sanitization on XML data to prevent XXE attacks. This can involve whitelisting allowed XML elements and attributes, disabling external entity resolution, and carefully validating user-supplied input. Web Application Firewalls (WAFs) can be configured to detect and block malicious XML payloads. Monitor application logs for suspicious XML parsing activity and unusual outbound network requests. After upgrading, confirm the fix by attempting to trigger the XXE vulnerability with a known malicious XML payload and verifying that the request is blocked or handled safely.