A critical XML External Entity (XXE) vulnerability in http4s-scala-xml allows unauthenticated remote attackers to perform unauthorized file disclosure and server-side request forgery.

The library uses a SAXParserFactory without proper security configurations for XML parsing, which enables the resolution of external entities and DTDs. This allows an unauthenticated remote attacker to supply malicious XML payloads to the application.

Successful exploitation poses a severe risk to organizational infrastructure, as attackers can read sensitive local files readable by the service process or leverage the service to conduct Server-Side Request Forgery (SSRF) against internal, non-public network resources. With a CVSS score of 9.3, this vulnerability is categorized as critical, necessitating immediate attention to prevent potential data breaches and internal network compromise.

Immediate Action: Upgrade to http4s-scala-xml versions 0.24.1 or 1.0.0-M39 or later to apply the necessary security configurations to the SAX parser.

Proactive Monitoring: Review application and network access logs for suspicious incoming POST requests containing XML DOCTYPE declarations or unexpected outbound requests originating from the application server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block or inspect XML payloads for DOCTYPE and ENTITY definitions, which can serve as a temporary mitigation until the library can be updated.

Public Exploit Available: Unknown

Given the critical CVSS severity and the ease of exploitation associated with XXE vulnerabilities, organizations utilizing http4s-scala-xml must prioritize this update. Administrators should immediately identify all services utilizing the affected library versions and schedule deployments to the patched releases to eliminate the risk of unauthorized data access and internal network exposure.