An unauthenticated XML External Entity vulnerability in MapFish Print allows remote attackers to exfiltrate sensitive files and perform unauthorized internal network requests.

The application fails to properly disable external entities and DTDs when parsing GML layer XML data at the /api/print3/print endpoint. This allows an unauthenticated attacker to manipulate XML inputs to access local system files, such as Kubernetes service tokens or certificates, or to conduct Server-Side Request Forgery (SSRF).

This vulnerability poses a critical risk to organizational security, as it allows attackers to bypass network perimeters to access sensitive internal data or cloud environment credentials. Given the CVSS score of 8.6, the potential for unauthorized data exposure is significant, threatening the confidentiality of the host infrastructure and any associated cloud service accounts.

Immediate Action: Upgrade mapfish-print to versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, or 4.0.5, which include the necessary fixes to disable dangerous XML entity processing.

Proactive Monitoring: Audit server access logs for anomalous requests to the /api/print3/print endpoint, specifically looking for XML payloads containing DOCTYPE declarations or external entity references.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to block incoming requests to the print endpoint that contain XML structures with external entity declarations.

Public Exploit Available: Unknown

Due to the severity of this vulnerability and the potential for complete exposure of sensitive environment tokens, organizations should prioritize the deployment of the vendor-supplied patches. Organizations operating MapFish Print in containerized or cloud-native environments, such as Kubernetes, must treat this as a high-priority remediation item to prevent the theft of service-account credentials.