AI analysis
Apache Sling XSS, the bundle that sanitizes and filters markup in Apache Sling-based web applications, improperly restricts recursive entity references in DTDs (CWE-776) in all versions before 2.4.12. An attacker can submit content containing deeply nested XML entity references, which the XSS filter's parser expands without adequate resource limits; the related advisory headline also points to missing parser resource limits. Because the vector is scored AV:N/PR:N/UI:R with changed scope and low confidentiality and integrity impact, the practical result is a client-side attack (XSS-like behavior in a victim's browser) when a victim interacts with a page that renders the filtered content, rather than direct server compromise. Applications built on Apache Sling — including Adobe AEM-based deployments that ship the Sling XSS bundle — are affected if they run a version older than 2.4.12. No public proof of concept is known, the issue is not on CISA's KEV list, and there is no evidence of in-the-wild exploitation.
What to do: Upgrade the Apache Sling XSS bundle to 2.4.12, and if you run Adobe AEM or another product that embeds Sling, apply the vendor update that ships the fixed bundle version. Until patched, review where user-supplied rich text passes through the XSS filter and consider disabling DTD/entity processing in the underlying parser configuration. Check application and CDN logs for requests containing nested XML entity definitions in fields that are later rendered to end users.
Affected
| Apache Software Foundation Apache Sling XSS | before 2.4.12 |
Estimated exposure
moderate≈ low thousands of internet-exposed Sling/AEM hosts, plausibly tens of thousands of sites served overall — Apache Sling is an enterprise Java framework best known as the foundation of Adobe Experience Manager; public internet scans typically show only a few thousand directly exposed Sling/AEM instances, but each instance often fronts many…
Description
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.