XML External Entity (XXE) Injection

2023-03-2211:52:43

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

xml external entity injection

vulnerability

arbitrary url disclosure

local file disclosure

libplist.so

EPSS

0.002

Percentile

55.8%

JSON

libplist.so is vulnerable to XML External Entity (XXE) Injection. The vulnerability exists due to the plist_from_xml function in xplist.c because external references are not restricted which allows an attacker to use a specifically crafted XML file to issue a request to an arbitrary URL or disclose a local file.