CVE-2021-47621

Executive Summary

CVE-2021-47621 identifies a critical XML External Entity (XXE) vulnerability in the ClassGraph library, versions prior to 4.8.112. This flaw allows an attacker to exploit XML parsing functionality to read arbitrary files on the server, perform server-side request forgery (SSRF), or cause a denial of service (DoS) via entity expansion. The vulnerability is classified under CWE-611 (Improper Restriction of XML External Entity Reference). Given the library's use in Java applications for classpath scanning and metadata extraction, this vulnerability poses a significant risk to applications that process untrusted XML input.

Supply Chain & Package Security

ClassGraph is a Java library distributed via Maven Central and other package repositories. Organizations using vulnerable versions (< 4.8.112) in their build pipelines or runtime environments are at risk. Attackers can exploit this vulnerability by supplying malicious XML data to any application component that uses ClassGraph for XML parsing. The lack of a CVSS score and EPSS data suggests limited public exploitation, but the technical impact is severe due to potential data exfiltration and lateral movement.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No direct DoS, but entity expansion can cause resource exhaustion.

Threat Level: High – Remote, unauthenticated file read with low complexity.

Deep Dive & Mechanics

ClassGraph is a Java library used for scanning the classpath, resolving annotations, and extracting metadata. It includes an XML parser that processes XML configuration files or data. In versions before 4.8.112, the XML parser was not configured to disable external entity processing. This allows an attacker to craft an XML payload containing an external entity reference that points to a local file (e.g., /etc/passwd) or an external URL.

When the vulnerable application parses the malicious XML, the parser resolves the external entity, reading the file content or making an HTTP request. This can lead to:

• File Disclosure: Reading sensitive files like configuration files, SSH keys, or database credentials.
• SSRF: Making requests to internal services, potentially bypassing firewalls.
• Denial of Service: Using entity expansion (e.g., Billion Laughs attack) to consume memory.

The fix in version 4.8.112 involves disabling external entity processing by setting DocumentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) and setFeature("http://xml.org/sax/features/external-general-entities", false).

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.8.112):

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlInput)));

Patched Code (4.8.112+):

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlInput)));

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Java application using ClassGraph < 4.8.112 that parses XML input.
• Network access to the application endpoint.

Exploit Payload (XXE for file read):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

Steps:

1. Identify an endpoint that accepts XML input (e.g., REST API, file upload).
2. Send the malicious XML payload.
3. Observe the response containing the contents of /etc/passwd or other targeted files.

Advanced Payload (SSRF):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://internal-service:8080/admin">
]>
<root>&xxe;</root>

Blue Team (Defense & Detection)

Detection:

• Monitor for XML payloads containing DOCTYPE, ENTITY, or SYSTEM keywords.
• Use WAF rules to block XML external entity declarations.
• Implement network segmentation to limit SSRF impact.

Honeypot:

• Deploy a fake endpoint that logs all XML input and alerts on suspicious patterns.

Mitigation:

• Upgrade ClassGraph to version 4.8.112 or later.
• If upgrade is not possible, apply a security wrapper that disables external entities in the XML parser.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unexpected internal IPs or ports.
• File System: Unauthorized reads of /etc/passwd, /etc/shadow, or application config files.
• Logs: XML parsing errors containing file paths or external URLs.
• Process: Java processes with high memory usage due to entity expansion.

Detection Engineering

YARA Rule

rule CVE_2021_47621_XXE_ClassGraph {
    meta:
        description = "Detects XXE payloads targeting ClassGraph library"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-47621"
    strings:
        $xml_doctype = /<!DOCTYPE\s+\w+\s*\[/ nocase
        $entity_system = /<!ENTITY\s+\w+\s+SYSTEM\s+/ nocase
        $file_protocol = /file:\/\// nocase
        $http_protocol = /http:\/\// nocase
    condition:
        $xml_doctype and ($entity_system and ($file_protocol or $http_protocol))
}

Sigma Rule

title: CVE-2021-47621 XXE Attempt via ClassGraph
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects XML external entity injection attempts against ClassGraph library
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'xml'
        cs-body|contains:
            - '<!DOCTYPE'
            - '<!ENTITY'
            - 'SYSTEM'
    condition: selection
falsepositives:
    - Legitimate XML processing with DTDs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2021-47621 XXE Attempt - ClassGraph"; flow:to_server,established; content:"<!DOCTYPE"; nocase; content:"<!ENTITY"; nocase; content:"SYSTEM"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade ClassGraph to version 4.8.112 or later.
2. Compensating Controls: If upgrade is not possible, implement a custom XML parser wrapper that disables external entities.
3. Network: Restrict outbound HTTP/HTTPS traffic from application servers to prevent SSRF.
4. Monitoring: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
5. Patch Management: Integrate ClassGraph into your vulnerability scanning and patch management process.

Valters IT Signature:
"Securing the digital frontier, one CVE at a time."