Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-59952

CVE-2025-59952: MinIO Java Client XML Tag Value Substitution Vulnerability

N/A

CVSS Score

Basic Information

CVE ID
CVE-2025-59952
GHSA ID
GHSA-h7rh-xfpj-hpcm
EPSS Score
0.27449%
CWE
CWE-20
Published
9/29/2025
Updated
9/30/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
io.minio:miniomaven< 8.6.08.6.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability is caused by the default behavior of the org.simpleframework.xml.core.Persister class, which is used for XML serialization and deserialization in minio-java. This class, by default, substitutes placeholders in the format ${...} with the values of system properties or environment variables. An attacker can exploit this by crafting a malicious XML payload that includes these placeholders. When a vulnerable version of the minio-java application processes this XML using the io.minio.Xml class, the placeholders are replaced with sensitive information from the server environment, which can then be exfiltrated.

The patch, identified in commit f7a98d06b25e5464bdd4811b044e25ff9101d37f, addresses this by creating a noopFilter that prevents any substitution from occurring. This filter is then applied to the Persister instance in all relevant methods within the io.minio.Xml class: marshal, unmarshal, and validate. These functions are the direct entry points for the vulnerability. The unmarshal and validate functions are vulnerable to malicious input from external sources, while marshal is patched to prevent scenarios where application data containing placeholders could be inadvertently exposed.

Vulnerable functions

io.minio.Xml.marshal
api/src/main/java/io/minio/Xml.java
The `marshal` function uses `org.simpleframework.xml.core.Persister` to serialize objects to XML. In vulnerable versions, the `Persister` was initialized without a filter, causing it to substitute system properties and environment variables in the output XML. An attacker could potentially control the data being marshalled, leading to information disclosure if the generated XML is processed further.
io.minio.Xml.unmarshal
api/src/main/java/io/minio/Xml.java
The `unmarshal` function (both overloads) is used to parse XML into Java objects. It uses `org.simpleframework.xml.core.Persister` which, in vulnerable versions, would substitute placeholders in the XML with system properties or environment variables. This is the primary vector for this vulnerability, as an attacker can provide a malicious XML file to read sensitive system data.
io.minio.Xml.validate
api/src/main/java/io/minio/Xml.java
Similar to `unmarshal`, the `validate` function processes an XML string. It uses `org.simpleframework.xml.core.Persister` which would perform variable substitution, allowing an attacker to craft a malicious XML that, when validated, could leak sensitive information from system properties or environment variables.

WAF Protection Rules

WAF Rule

#### **s*ription In minio-j*v* v*rsions prior to *.*.*, XML t** v*lu*s *ont*inin* r***r*n**s to syst*m prop*rti*s or *nvironm*nt v*ri**l*s w*r* *utom*ti**lly su*stitut** wit* t**ir **tu*l v*lu*s *urin* pro**ssin*. T*is unint*n*** ****vior *oul* l***

Reasoning

T** vuln*r**ility is **us** *y t** ****ult ****vior o* t** `or*.simpl**r*m*work.xml.*or*.P*rsist*r` *l*ss, w*i** is us** *or XML s*ri*liz*tion *n* **s*ri*liz*tion in `minio-j*v*`. T*is *l*ss, *y ****ult, su*stitut*s pl****ol**rs in t** *orm*t `${...}