CVE-2021-32623

Executive Summary

CVE-2021-32623 is a high-severity (CVSS 8.1) XML Entity Expansion vulnerability — commonly known as the "billion laughs" attack — affecting Opencast, a free and open-source video capture and distribution platform. All versions prior to 9.6 are vulnerable, allowing an authenticated user with ingest privileges to trigger a permanent denial-of-service condition against the server with a single HTTP request. The vulnerability is fixed in Opencast 9.6; however, no workaround exists for affected deployments, and no patch evidence has been tracked by independent sources. The attack does not require prior exploitation of other flaws but does require a low-privilege account, narrowing the potential attacker pool to internal users or compromised ingest accounts. There is no evidence of exploitation in the wild (EPSS: 0.01254, CISA KEV: NO).

Technical Analysis

The vulnerability is rooted in the XML parser configuration used by Opencast during the processing of externally supplied XML data. The "billion laughs" attack abuses XML Document Type Definitions (DTDs) that define nested entity expansions. Each entity in the DTD references previously defined entities, causing the parser to expand the entity hierarchy exponentially. For example, a small payload of a few kilobytes can expand to hundreds of gigabytes of in-memory text, exhausting CPU and memory resources.

Specifically, the attack occurs during the parsing of XML documents that include a <!DOCTYPE> declaration and custom entities. When Opencast's XML processing endpoint receives a crafted document, the parser attempts to resolve these recursive entities, eventually consuming all available system resources. The exponential expansion (entities referencing entities, each of which multiplies in size) causes the parser to spin indefinitely or crash with an out-of-memory error.

The vulnerability is classified under CWE-776, which describes improper restriction of recursive entity references — a mitigation gap where the XML parser is not configured to disable DTD processing or enforce entity expansion limits.

Attack surface: The attack requires that the user possesses "ingest privileges" — the ability to submit media content or metadata to Opencast. This reduces the attack surface to authenticated users, but the privilege boundary is low: ingest accounts are typically provisioned for automated capture agent systems and may have weak or reused credentials.

Technical gap: The NVD description does not specify the exact XML parser library, the specific HTTP endpoint that accepts XML input, or the request format (e.g., POST body vs. multipart upload). Insufficient technical detail is available in the description to pinpoint the exact code path within Opencast. The analysis above is based on the vulnerability class (CWE-776) and the acknowledged attack vector (HTTP request with ingest privileges).

Exploitation Scenarios

Based strictly on the NVD description, the attack chain is as follows:

Step 1 — Reconnaissance / Target Identification An operator with ingest credentials first identifies an Opencast instance. This may be done through Shodan searching for Opencast-style web interfaces or by performing organizational reconnaissance to discover the media platform domain. The attacker then validates that their ingest account is authorized, either through normal login to the ingest interface or by attempting a benign HTTP request that requires authentication.

Step 2 — Triggering the Flaw Class The attacker constructs a minimal XML document that includes a DTD with nested entity declarations. This document does not need to contain any legitimate media data; it only needs to pass the authentication and authorization checks for ingest. The payload is delivered via an HTTP request to the XML-processing endpoint. The specific endpoint is unknown from the data provided, so the attack is described at the vulnerability-class level: the attacker submits XML to any Opencast feature that parses user-supplied XML.

Step 3 — Payload / Execution Method Given that the flaw is CWE-776 (recursive entity expansion), the payload will follow the classic billion-laughs template. A DTD declares entities such as lol1, lol2, ..., each of which references the prior entity multiple times. The final entity reference is placed in the document body, causing the parser to expand it recursively. The small payload expands to a massive amount of text, consuming CPU and memory. No public PoC is available; the attack chain is inferred from the vulnerability class.

Step 4 — Post-Exploitation Impact The resource exhaustion causes the Opencast process to hang, crash, or be terminated by the operating system's OOM killer. Because the entity expansion happens synchronously during request handling, the denial of service is not transient — the server may require a restart and potentially manual cleanup of partially written data. The impact is described as "permanent" in the NVD description, meaning that the system does not recover automatically. This effectively takes the entire Opencast platform offline, affecting video capture, processing, and distribution operations.

Impact Assessment

Business Impact: Opencast is deployed primarily by educational institutions, universities, and enterprises that operate lecture capture and internal video distribution infrastructure. A denial of service takes down the entire platform, halting live capture, video processing, and streaming services. The "permanent" nature of the DoS implies recovery requires operator intervention, potentially resulting in hours of downtime and significant operational disruption.

CVSS Context: The base score of 8.1 corresponds to Attack Vector: Network, Attack Complexity: Low, Privileges Required: Low, User Interaction: None, Scope: Unchanged, Confidentiality: None, Integrity: None, Availability: High. The low privilege requirement acknowledges the ingest-privilege restriction, but the attack requires no user interaction and is trivial in complexity.

Blast Radius: Each vulnerable Opencast instance is an independent target. The attacker controls a single account; lateral movement is not achieved — the impact is confined to the affected service. However, because the DoS is manual-recovery-dependent, availability risk is elevated. There are no confidentiality or integrity impacts, as the attack does not read or modify data.

Affected Systems: All Opencast deployments prior to version 9.6, including long-term support branches if present. No OSV package information is available to enumerate specific Linux distribution packages.

Detection Guidance

The following detection logic targets the signature of the billion-laughs payload: XML documents containing declarations with entity names such as lol, haha, or booo, and requests to XML-processing endpoints with unusually small body sizes and a Content-Type: application/xml header.

Sigma Rule

title: Billion Laughs XML Entity Expansion Attempt against Opencast
id: 8f2a4c5e-9b7d-4c31-9a0f-1d4e5f6a7b8c
status: experimental
description: Detects HTTP requests to Opencast XML processing endpoints containing recursively defined XML entities (billion laughs attack).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32623
author: Valters IT Research
date: 2025-01-01
logsource:
    category: webserver
    product: apache
    definition: 'HTTP server logs in front of Opencast'
detection:
    selection_content_type:
        cs-method: 'POST'
        cs-content-type: 'application/xml'
        cs-uri-extension: 'xml'
    selection_entity:
        cs-body|contains:
            - '<!ENTITY'
            - 'lol'
            - 'aha'
            - 'booo'
        cs-body|re:
            - 'ENTITY\s+\w+\s+"[^"]+"'
    condition: all of selection_*
falsepositives:
    - Legitimate metadata ingestion with valid DTDs
level: high

YARA Rule

rule Opencast_Billion_Laughs_Exploit
{
    meta:
        author = "Valters IT Research"
        description = "Detects XML payloads containing recursively nested entities (billion laughs) targeting Opencast"
        cve = "CVE-2021-32623"
        date = "2025-01-01"
        severity = "high"
    strings:
        $s1 = "<!ENTITY" ascii nocase
        $s2 = "lol" ascii nocase
        $s3 = "haha" ascii nocase
        $s4 = "booo" ascii nocase
        $s5 = "<!DOCTYPE" ascii nocase
        $s6 = "xml" ascii nocase
    condition:
        filesize < 10KB and
        $s1 and $s5 and $s6 and 1 of ($s2, $s3, $s4)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"OPencast Billion Laughs XML Entity Expansion Attempt (CVE-2021-32623)"; flow:established,to_server; http.method; content:"POST"; http.header_names; content:"Content-Type"; nocase; http.header_value; content:"application/xml"; nocase; http.request_body; content:"<!ENTITY"; nocase; content:"lol"; nocase; within:200; content:"<!DOCTYPE"; nocase; distance:100; http.request_body; content:"xml"; nocase; within:50; classtype:attempted-dos; sid:20250101; rev:1; metadata:created_at 2025-01-01, cve CVE-2021-32623;)

Elastic Detection

sequence by source.ip
  [ network where event.type == "start" and destination.port == 80 ]
  [ http where http.request.method == "POST" and http.request.body.content_type == "application/xml"
      and (http.request.body.content contains "<!DOCTYPE" and http.request.body.content contains "lol" ) ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST"
| where like(content_type, "%application/xml%")
| where like(body, "%<!DOCTYPE%") AND like(body, "%lol%")
| table _time, src_ip, uri, body
| eval attack_indicator = case(
    match(body, ".*ENTITY.*lol.*"), "Billion Laughs - entity named lol",
    match(body, ".*ENTITY.*haha.*"), "Billion Laughs - entity named haha",
    match(body, ".*ENTITY.*booo.*"), "Billion Laughs - entity named booo",
    true(), "Review manually")
| stats count by attack_indicator, src_ip, uri

Wazuh OSSEC Rule

<group name="opencast,">
  <rule id="100101" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="content_type">application/xml</field>
    <regex>(\<!DOCTYPE.*\<!ENTITY.*lol)</regex>
    <description>Opencast: possible Billion Laughs (CVE-2021-32623) XML entity expansion attempt</description>
    <mitre>
      <id>T1498.002</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source).
Although the NVD description states the fix is in Opencast 9.6, no vendor advisory, patch commit, or OSV package update has been tracked in our intelligence sources. Commands below assume an official fix is issued.

1. Immediate Mitigations

• Restrict network access to the Opencast web interface to trusted subnets only; do not expose it directly to the internet.
• Enforce strong authentication requirements and enable multi-factor authentication for all ingest accounts.
• Revoke unused ingest credentials; audit and rotate existing ingest account passwords.
• Implement web application firewall (WAF) rules to block HTTP requests containing DTD declarations (<!DOCTYPE).
• Deploy a reverse proxy with request body size limits (e.g., 1MB) to reject oversized XML payloads at the edge.
• Monitor for anomalous request patterns: multiple small POST requests with application/xml content type.

2. Patch / Upgrade Steps

• Upgrade Opencast to version 9.6 or later once the patch is verified from the official vendor source (https://github.com/opencast/opencast).
• Before upgrading, test the deployment in a staging environment and verify the XML parser configuration disables DTD processing.
• After upgrade, confirm the HTTP endpoint rejects DTD-containing XML payloads.

3. Long-Term Hardening

• Implement a content security policy for the web application layer to restrict XML parsing to expected endpoints.
• Enforce least-privilege principles: separate ingest accounts from administrative accounts; grant ingest privileges only to trusted capture agents.
• Enable resource limits at the OS/container level (ulimit, cgroup memory limits) to protect the host from complete resource exhaustion.
• Subscribe to the Opencast security mailing list for future advisories.
• Add HTTP anomaly detection in your SIEM to flag XML expansion patterns.

References

1. NVD — CVE-2021-32623 Detail: https://nvd.nist.gov/vuln/detail/CVE-2021-32623
2. Opencast Project Official Repository: https://github.com/opencast/opencast
3. Opencast Release Notes (for version 9.6): https://docs.opencast.org
4. MITRE ATT&CK — T1498.002 Reflection Amplification: https://attack.mitre.org/techniques/T1498/002/
5. CWE-776 — Improper Restriction of Recursive Entity References: https://cwe.mitre.org/data/definitions/776.html

Threat Actor Campaigns / Weaponization: No known threat actor campaigns or public exploit attempts have been identified in tracked data sources. CISA KEV does not list this CVE as exploited in the wild. The EPSS score (0.01254) indicates a very low probability of active exploitation; however, this may increase if a public PoC is released. No exploit code or Nuclei template exists at the time of this report.