CVE-2025-27136 – LocalS3 CreateBucketConfiguration XXE Injec...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.offsec.com/blog/cve-2025-27136/
• Blog Title: CVE-2025-27136 – LocalS3 CreateBucketConfiguration XXE Injection
• Suggested Section: generic-hacking/xxe-injection.md

🎯 Content Summary

CVE-2025-27136: XML External Entity (XXE) Injection in LocalS3

Overview

The CVE-2025-27136 vulnerability is an XML External Entity (XXE) injection in LocalS3’s CreateBucketConfiguration endpoint affecting all versions prior to 1.21. With a CVSS 3.1 score of 5.5 (Medium), this flaw allows unauthenticated remote attackers to read arbitrary files from the server’s filesystem by abusing external e...

🔧 Technical Details

Java’s DocumentBuilderFactory and similar XML parsers resolve external entities by default unless explicitly disabled, enabling XXE attacks.

An attacker crafts a <!DOCTYPE> declaration with a SYSTEM entity pointing to a file:// or http:// URI (e.g., <!ENTITY xxe SYSTEM "file:///etc/passwd">) and injects &xxe; into an XML element. The parser fetches and substitutes the external resource, leading...

🤖 Agent Actions

Added a comprehensive “Java DocumentBuilderFactory hardening example” section to the XXE guide (src/pentesting-web/xxe-xee-xml-external-entity.md):

1. Explained insecure default usage of DocumentBuilderFactory in Java.
2. Provided secure configuration code snippet disabling external entities, DOCTYPE, etc.
3. Clarified defensive flags and real-world relevance referencing CVE-2025-27136 (LocalS3).
4. Updated References section to include OffSec blog source link.

This enhances Java-specific mitigation coverage for XXE attacks.

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.offsec.com/blog/cve-2025-27136/

Content Categories: Based on the analysis, this content was categorized under "generic-hacking/xxe-injection.md".

Repository Maintenance:

• MD Files Formatting: 860 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge