Christian Bülter

The OOXML parsing of the file indexer fails to disable external entity resolution. This allows an attacker to use a specially crafted xlsx or pptx document placed in an indexed directory to trigger XML External Entity (XXE) injection—a process where an application processes external entities within an XML document. This can result in the reading of local files or the execution of outbound HTTP requests, with the retrieved data being written to the search index.

The `additional tables` configuration of the page and tt content indexers allows the use of arbitrary table and field names. A backend user with permissions to edit indexer configurations can exploit this to copy sensitive data from internal tables into the search index.

The file indexer fails to normalize the configured directory path. This allows a backend user with permissions to edit indexer configurations to index documents from arbitrary locations on the server file system by using path traversal sequences, which are characters used to navigate through the directory hierarchy to access files outside the intended folder.

The issue allows remote attackers to execute arbitrary SQL commands. This has been exploited in the wild.