org.springframework.restdocs:spring-restdocs-restassured@3.0.5

org.springframework.restdocs:spring-restdocs-restassured is a

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. due to improperly configured XML parsing in the PrettyPrintingContentModifier and XmlContentHandler classes, in PrettyPrintingContentModifier.java and payload/XmlContentHandler.java. When the spring-restdocs-webtestclient or spring-restdocs-restassured integration is used to document a remote API accessed over HTTP, XML content returned by the remote service is parsed with external entity resolution enabled. An attacker who compromises the documented API, or who tricks a user into documenting a malicious API, can embed external entity declarations in the XML, and these entities are resolved the next time the documentation-generating tests are executed. This exposes files readable by the test process to the attacker-controlled endpoint and enables limited denial of service through entity expansion.

Note:

This is only exploitable if the attacker first compromises or impersonates the API being documented, and if the victim user runs the documentation-generating tests.

A fix was pushed into the master branch but not yet published.