CVE-2017-12621: Apache Commons Jelly XML External Entity (XXE) Vulnerability
Summary
CVE-2017-12621: Improper Restriction of XML External Entity Reference in Jelly. Affects commons-jelly:commons-jelly versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Jelly is a Java and XML based scripting and processing engine. It allows developers to write XML-based scripts that can be executed to perform various tasks. The vulnerability in Apache Commons Jelly versions prior to 1.0.1 is related to improper restriction of XML external entity references in Jelly files. This vulnerability can be exploited through the use of custom doctype entities with a "SYSTEM" entity containing a URL. When a Jelly file containing such an entity is parsed, the parser attempts to connect to the specified URL, potentially leading to XML External Entity (XXE) attacks.
Vulnerability Detail
The vulnerability arises during the parsing of Jelly files with Apache Xerces. If a custom doctype entity is declared with a "SYSTEM" entity containing a URL and that entity is used in the body of the Jelly file, the parser will attempt to connect to the specified URL. This behavior can be exploited by an attacker to perform XML External Entity (XXE) attacks. By providing a malicious XML file with specially crafted external entity references, an attacker can read sensitive data from the server, perform SSRF attacks, or cause denial of service.
How To Fix
Latest published version: 1.0.1 as of 23 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the processing of external entities in the XML parser configuration. This can be achieved by setting the "FEATURE_SECURE_PROCESSING" property to true. Here is an example of how to disable external entity processing in Java:
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);
By disabling external entity processing, the vulnerability can be mitigated, but it is still recommended to upgrade to the latest version as soon as possible.
Conclusion
The Apache Commons Jelly XML External Entity (XXE) vulnerability can be exploited to perform various attacks, including unauthorized data access and denial of service. To mitigate the risk, it is crucial to upgrade to Apache Commons Jelly version 1.0.1 or later. Additionally, disabling external entity processing can provide temporary protection. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for commons-jelly:commons-jelly →
FAQ
Apache Commons Jelly is a Java and XML based scripting and processing engine. It allows developers to write XML-based scripts that can be executed to perform various tasks.
An XML External Entity (XXE) attack is a type of attack where an attacker can exploit vulnerabilities in XML parsers to read sensitive data from the server, perform server-side request forgery (SSRF) attacks, or cause denial of service.
This vulnerability occurs when a custom doctype entity with a "SYSTEM" entity containing a URL is declared in a Jelly file and that entity is used in the body of the file. The XML parser attempts to connect to the specified URL during parsing, which can be exploited by an attacker.
The potential consequences of this vulnerability include unauthorized access to sensitive data, server-side request forgery (SSRF) attacks, and denial of service.
To mitigate the risk of this vulnerability, it is recommended to upgrade to Apache Commons Jelly version 1.0.1 or later. If upgrading is not immediately feasible, you can temporarily disable external entity processing in the XML parser configuration.
