PowSyBl Core XML Reader permite XXE y SSRF

The SSRF vulnerability in powsybl-commons arises from improper handling of XML input, leading to an XML External Entity (XXE) attack. An attacker can craft malicious XML payloads that instruct the application to make requests to internal or external resources. This can be leveraged to read arbitrary files on the server, potentially exposing sensitive data such as configuration files, credentials, or other confidential information. The impact is amplified in multi-tenant environments where multiple users share the same application instance, as a successful attack could compromise the entire system. The ability to read sensitive files represents a significant security risk, potentially leading to data breaches and system compromise.

Applications utilizing com.powsybl:powsybl-commons versions 6.7.1 or earlier are at risk. This includes Java-based applications, particularly those that process XML data from untrusted sources, such as multi-tenant applications or those integrating with external systems. Legacy systems that have not been regularly updated are also at increased risk.

• java / server:

find / -name "powsybl-commons-*.jar" -print0 | xargs -0 java -jar <jar_file> -Djava.security.xml.external.entities=null -Djava.security.xml.external.dtd=null

• linux / server:

journalctl -u <application_name> | grep -i "xml parsing" 

• generic web:

curl -I <application_url>/xml-endpoint | grep -i "Server: Powsybl"

1. 2025-06-19Disclosure

   disclosure

1. Reservado2025-05-05
2. Publicada2025-06-19
3. Modificada2025-06-20
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-47293 is to upgrade to powsybl-commons version 6.7.2 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing input validation and sanitization on XML data to prevent XXE attacks. This can involve whitelisting allowed XML elements and attributes, disabling external entity resolution, and carefully validating user-supplied input. Web Application Firewalls (WAFs) can be configured to detect and block malicious XML payloads. Monitor application logs for suspicious XML parsing activity and unusual outbound network requests. After upgrading, confirm the fix by attempting to trigger the XXE vulnerability with a known malicious XML payload and verifying that the request is blocked or handled safely.