GHSA-2466-4485-4pxj: 
Java vulnerability analysis and mitigation

The LocalS3 project contains an XML External Entity (XXE) Injection vulnerability (GHSA-2466-4485-4pxj) discovered in its bucket operations that process XML data, specifically in the bucket ACL and bucket tagging operations. The vulnerability was identified on March 9, 2025, affecting version 1.20 of the io.github.robothy:local-s3-rest Maven package. The issue stems from the XML parser processing DOCTYPE declarations and allowing external entity references without proper security controls (GitHub Advisory).

The vulnerability occurs because the XML parser used by the application processes XML input without properly disabling external entity resolution. When processing bucket ACL or tagging operations, the application includes the content of external entities in its response. The vulnerability has been assigned a CVSS v4 base score of 6.9 (Moderate severity) with the following vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. The vulnerability is classified as CWE-611 (GitHub Advisory).

The vulnerability requires no authentication and can be exploited by any user who can make HTTP requests to the server. It allows reading arbitrary files from the server's filesystem, which could expose sensitive configuration files, credentials, or other confidential information. Additionally, the vulnerability can be used to perform Server-Side Request Forgery (SSRF) attacks against internal systems (GitHub Advisory).

Several mitigation strategies have been implemented and recommended: Configure the XML parser to disable external entity resolution by setting XMLConstants.FEATURE_SECURE_PROCESSING to true, disable DOCTYPE declarations in the XML parser configuration, implement XML input validation and sanitization before processing, and consider using JSON instead of XML for these operations if XML parsing is not strictly necessary. A patch has been released in version 1.21 that addresses this vulnerability by disabling DTDs and external entities (GitHub Commit).