CVE-2020-14940: 
NixOS vulnerability analysis and mitigation

A vulnerability was discovered in TuxGuitar version 1.5.4, identified as CVE-2020-14940. The issue involves misconfigured XML parsers in the io/gpx/GPXDocumentReader.java file, which leads to XML External Entity (XXE) vulnerability while loading GP6 (.gpx) and GP7 (.gp) tablature files. The vulnerability was discovered and initially reported privately on May 15, 2020 (LogicalTrust Blog).

The vulnerability stems from an improperly configured XML parser in the GPXDocumentReader class. The code uses DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(stream) without implementing necessary XXE prevention configurations. This affects the parsing of GP6 and GP7 formats, which are archives containing XML documents. The GP7 format specifically contains a score.gpif XML file that can be manipulated to include malicious external entities (LogicalTrust Blog, SourceForge Bug).

The vulnerability allows attackers to steal content of local files from users' systems through maliciously crafted tablature files. However, there are two limitations: the attack generates noticeable parsing errors making it obvious to users that something is wrong, and due to Java's URL parser implementation, files containing newline characters cannot be stolen. The vulnerability can also be exploited for SSRF attacks against internal services and to leak users' IP addresses (LogicalTrust Blog).

The vulnerability is exploitable through specially crafted GP7 tablature files. An attacker can create a malicious file that uses external entities to exfiltrate local file contents when opened in TuxGuitar. The risk is heightened because users commonly download and open tablature files from the internet (LogicalTrust Blog).

The recommended fix involves properly configuring the XML parser by disabling external entities. This can be implemented by adding the following configuration: DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl"; dbf.setFeature(FEATURE, true); The fix has been implemented in the TuxGuitar GitHub repository and is available in releases from pre-release 2023-10-11 (SourceForge Bug).