Miggo Logo
Miggo Vulnerability Database
→
CVE-2016-15026

CVE-2016-15026: dd-plist XML External Entitly vulnerability

7.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2016-15026
GHSA ID
GHSA-4jx2-hvqw-93j9
EPSS Score
0.1972%
CWE
CWE-611
Published
2/20/2023
Updated
10/20/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.googlecode.plist:dd-plistmaven< 1.181.18

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure XML parser configuration in pre-1.18 versions. Key indicators:

  1. The commit patching CVE-2016-15026 shows significant changes to XMLPropertyListParser.java's DocumentBuilderFactory configuration
  2. Pre-patch code lacked features like setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false)
  3. The original EntityResolver only handled Apple DTDs but didn't block other external entities
  4. All XML parsing flows went through getDocBuilder(), making it the central vulnerable component
  5. The NVD description explicitly cites improper restriction of XML external entity references as the root cause

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* in **r***t **-plist *.** *n* *l*ssi*i** *s pro*l*m*ti*. *****t** *y t*is issu* is som* unknown *un*tion*lity. T** m*nipul*tion l***s to xml *xt*rn*l *ntity r***r*n**. *n *tt**k **s to ** *ppro***** lo**lly. Up*r**in* to v*rs

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* XML p*rs*r *on*i*ur*tion in pr*-*.** v*rsions. K*y in*i**tors: *. T** *ommit p*t**in* *V*-****-***** s*ows si*ni*i**nt ***n**s to XMLProp*rtyListP*rs*r.j*v*'s *o*um*nt*uil**r***tory *on*i*ur*tion *. Pr*-p*t** *o*