Copernik XML Factory through version 0.1.1, when running on its default JDK XML provider (not Apache Xerces), fails to block XInclude resource resolution after an application enables XInclude on factories returned by XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory(), or on an XMLReader hardened by XmlFactories.harden(). This allows an attacker to exploit XInclude references in untrusted XML to read local files or reach internal network endpoints via HTTP, causing information disclosure and SSRF. The vulnerability requires that the application enables XInclude and parses untrusted XML using the stock JDK provider. The Xerces and Android providers are not affected. The issue is fixed in version 0.1.2, and as a workaround, adding Apache Xerces to the classpath forces selection of the unaffected Xerces provider.

An attacker can exploit this vulnerability by supplying crafted XML containing XInclude references to cause the application to resolve external resources. This can lead to local file disclosure or server-side request forgery (SSRF) to internal network endpoints. The impact is limited to applications that enable XInclude and parse untrusted XML using the stock JDK provider. The vulnerability does not allow remote code execution or privilege escalation but can expose sensitive information and internal services.

A fix is available in Copernik XML Factory version 0.1.2. Applications should upgrade to this version to remediate the vulnerability. As a temporary workaround, adding Apache Xerces (xercesImpl) to the classpath will cause the library to select the unaffected Xerces provider, mitigating the issue. No other actions are required if these steps are taken.