<!-- Note that this issue is configured (see the quick actions at the bottom) to be created as confidential. Note that a vulnerability does not need to actually be resolved before it is reported and that these reports can be revised as needed (reopen the issue to request changes). If you do not know how to fill certain fields, mark that in the comment and we will help you. You can delete the comments (or not). --> <!-- Required. Specify the project's name (e.g., "Eclipse Dash") and Eclipse Foundation ID, e.g., "technology.dash". --> ## Basic information **Project name:** Eclipse Memory Analyzer **Project id:** tools.mat ## What are the affected versions? All versions prior to 1.15.0 including 1.14.0 and earlier. ## Details of the issue A user can choose to create a report in Eclipse Memory Analyzer using an external report definition file from an untrusted source defined in XML. If this report definition file has been configured to have a XML External Entity (XXE) processing attack then Eclipse Memory Analyzer could access unexpected external data. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts. However, in general, users should not run untrusted external report definition files with Eclipse Memory Analyzer as the report definition is like a script and could run any defined Memory Analyzer query or report. ## Steps to reproduce Take a Eclipse Memory Analyzer report file. Add a sample XXE attack to the XML, for example: ``` <!DOCTYPE root_element SYSTEM "file:///c:/mysecret.txt"> ``` and used the Memory Analyzer 'Run Report' menu option to select and run the report XML on the current heap dump snapshot. Look for an error message in the error log. ``` java.io.FileNotFoundException: c:\mysecret.txt (The system cannot find the file specified) at java.base/java.io.FileInputStream.open(Unknown Source) at java.base/java.io.FileInputStream.<init>(Unknown Source) at java.base/java.io.FileInputStream.<init>(Unknown Source) at java.base/sun.net.www.protocol.file.FileURLConnection.connect(Unknown Source) at java.base/sun.net.www.protocol.file.FileURLConnection.getInputStream(Unknown Source) at java.xml/com.sun.org.apache.xerces.internal.impl.XMLEntityManager.setupCurrentEntity(Unknown Source) ``` ## Do you know any mitigations of the issue? Run Eclipse Memory Analyzer with these JVM options in `MemoryAnalyzer.ini`. ``` -Djavax.xml.accessExternalSchema= -Djavax.xml.accessExternalDTD= ``` Eclipse Memory Analyzer version 1.15.0 will contain a fix for this issue. See [bug 582681](https://bugs.eclipse.org/bugs/show_bug.cgi?id=582631). <!-- Please, do not remove the line below. It will create a confidential issue that will be visible only to you and the members of this project. Confidential issues are used to keep security vulnerabilities private until they are sorted out. Eclipse Projects follow Responsible Disclosure best practices: the initial report is made privately, but with the full details being published once a patch has been made available (sometimes with a delay to allow more time for the patches to be installed). -->