CSSA Exclusive Early Warning9.1 Critical
AndroidAsync parsing malicious XML external entities leading to sensitive data disclosure and service disruption
This flaw stems from the underlying document builder factory not enabling secure configuration parameters at instantiation. An attacker can exploit it remotely by crafting an HTTP response carrying a malicious document type definition and external entity declarations. When the target application calls the text-based XML parsing interface to process an untrusted data source by default, the parsing engine automatically triggers external resource reference logic, leading to local file system reads, server-side request forgery, or exhaustion of compute resources caused by exponential entity expansion.
Component
AndroidAsync is an asynchronous communication framework designed around a non-blocking network I/O model. Its architecture uses an event-driven mechan…
Type
XXE (CWE-611)
Repo
github.com/koush/AndroidAsync · Stars 7541
Remediation
- It is recommended that developers forcibly disable loading of external general and parameter entities when initializing the XML parser, turn off document type declaration parsing, enable secure processing features and restrict external DTD references, while using exception handling to remain compatible with different underlying parser implementations for code portability.
