org.springframework.restdocs:spring-restdocs-core@4.0.0

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection due to improperly configured XML parsing in the PrettyPrintingContentModifier and XmlContentHandler classes, in PrettyPrintingContentModifier.java and payload/XmlContentHandler.java. When the spring-restdocs-webtestclient or spring-restdocs-restassured integration is used to document a remote API accessed over HTTP, XML content returned by the remote service is parsed with external entity resolution enabled. An attacker who compromises the documented API, or who tricks a user into documenting a malicious API, can embed external entity declarations in the XML, and these entities are resolved the next time the documentation-generating tests are executed. This exposes files readable by the test process to the attacker-controlled endpoint and enables limited denial of service through entity expansion.

Note:

This is only exploitable if the attacker first compromises or impersonates the API being documented, and if the victim user runs the documentation-generating tests.

Upgrade org.springframework.restdocs:spring-restdocs-core to version 3.0.6, 4.0.1 or higher.