CVE-2025-27136: 
Java vulnerability analysis and mitigation

LocalS3, an Amazon S3 mock service for testing and local development, was found to contain a vulnerability in its bucket creation endpoint prior to version 1.21. The vulnerability (CVE-2025-27136) was discovered in March 2025 and involves an XML External Entity (XXE) injection vulnerability that affects the CreateBucketConfiguration XML document processing. This security issue allows attackers to perform server-side request forgery (SSRF) attacks through malicious XML input (GitHub Advisory).

The vulnerability occurs during the location constraint processing, where the XML parser is configured to resolve external entities without proper validation or restrictions. When processing the CreateBucketConfiguration XML document, the service's XML parser resolves external entities, allowing attackers to declare an external entity that references an internal URL. The server then attempts to fetch this URL when parsing the XML, making HTTP requests to the specified URL and including the response content in the parsed XML document. The vulnerability has been assigned a CVSS 4.0 score of 5.5 (MEDIUM) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P (NVD).

The vulnerability enables attackers to perform server-side request forgery (SSRF) attacks, allowing them to make requests to internal services or resources that should not be accessible from external networks. The server includes the responses from these internal requests in the resulting bucket configuration, effectively leaking sensitive information. The attacker only needs to be able to send HTTP requests to the LocalS3 service to exploit this vulnerability (GitHub Advisory).

The vulnerability has been fixed in version 1.21 by disabling XML external entity resolution in the XML parser configuration. The fix includes setting XMLInputFactory.SUPPORTDTD to FALSE and XMLInputFactory.ISSUPPORTINGEXTERNALENTITIES to FALSE. Additional recommended mitigations include implementing proper input validation for XML documents, rejecting those that contain DOCTYPE declarations or external entity references, and using XML parsers that are configured securely by default (GitHub Commit).