pmml4s_xxe_poc

pypmml / pmml4s XXE PoC (CWE-611)

Proof of concept for an XML External Entity vulnerability in the pypmml PMML loader, which delegates parsing to the bundled pmml4s Scala library. Loading an untrusted .pmml model file leaks local files into the parsed model (file read) and triggers outbound requests (SSRF).

Affected

• pypmml 1.5.8 (latest on PyPI), which bundles pmml4s_2.13-1.5.8.jar (latest pmml4s release)
• Reproduced on OpenJDK 21

Root cause

pmml4s creates its StAX reader from XMLInputFactory.newFactory with none of the hardening properties set (org/pmml4s/xml/pull.scala:91): no SUPPORT_DTD=false, no IS_SUPPORTING_EXTERNAL_ENTITIES=false, no ACCESS_EXTERNAL_DTD="". With JAXP/StAX defaults (SUPPORT_DTD=true, IS_REPLACING_ENTITY_REFERENCES=true, accessExternalDTD="all"), the parser resolves external general entities declared in the document DOCTYPE.

The entry points Model.load, Model.fromString, Model.fromFile, Model.fromBytes all reach the unhardened reader. Resolved entity content is stored in model expressions (a Constant inside a DerivedField, or InlineTable cells), so the leaked content is observable in the loaded model object.

Files

• poc.py — driver (file-read and SSRF demos)
• xxe_file_read.pmml — declares an external entity pointing at a local file; its content lands in a DerivedField Constant
• xxe_ssrf.pmml — declares an external entity pointing at an HTTP URL; loading fires the request

Run

pip install pypmml          # pulls JPype1 + py4j, bundles pmml4s_2.13-1.5.8.jar; needs a JRE on PATH
python poc.py file          # FILE READ: leaks /tmp/pmml4s_xxe_canary.txt into the model
python poc.py ssrf          # SSRF: load fires an outbound GET to a local listener

Expected output (file read)

[*] Canary file /tmp/pmml4s_xxe_canary.txt = 'SECRET-API-KEY-pmml4s-xxe-7f3a9c2e'
[*] DerivedField('leak').expr.value = 'SECRET-API-KEY-pmml4s-xxe-7f3a9c2e'
>>> XXE FILE READ CONFIRMED: file content exfiltrated into the model <<<

Impact

Loading an untrusted model file leaks local files readable by the process and lets an attacker reach internal network endpoints. PMML files are shared as plain XML and treated as data, so users do not expect file read or network access from loading one.

Fix

On the XMLInputFactory set supportDTD=false (or at minimum isSupportingExternalEntities=false and ACCESS_EXTERNAL_DTD="") before creating the reader.