The following issue was reported for Freeplane:
XML External Entity vulnerability in map parser - Freeplane Documentation
A quote from the report:
Reported on 2017/02/19
Fix released on 2017/04/15Reported by Wojciech Reguła, https://www.linkedin.com/in/wojciech-regula/
Description of VulnerabilityThe vulnerability allowed to download any file from victim's computer when the victim opens the malicious mindmap. The vulnerability pattern is described at https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing.
There is a report from Wojciech Reguła, 19 Mar 2018:
FreePlane <= 1.5.9 XXE, wojciechregula.blog
A quote from the report:
Vulnerability descripton: FreePlane is a Java-based app that loads its mind maps that are stored as simple XML files. The parser allowed to expand external entities that caused this vulnerability.
To parse a mind map, FreeMind 1.0.1 uses a modified version of NanoXML/Lite 2 (or "NanoXML 2 Lite"). It uses different XML components for other purposes (e.g. JiBX; see also Components in the wiki), but that is not relevant for an issue impacting the mind map parsing. NanoXML/Lite 2 was used by FreeMind since some version before FreeMind 0.7.1.
At the time of reporting of the issue for Freeplane (19 Feb 2017 as per above), the most recent stable version of Freeplane was 1.5.18, from 7 Dec 2016. That Freeplane version does not use NanoXML/Lite but rather a modified version of NanoXML/Java. NanoXML/Java has many more features and files than NanoXML/Lite, which is very lightweight with its only two files. The issue was fixed in Freeplane 1.5.20. My (Dan Polansky's) verification included an inspection of history.txt as well as an inspection of the differences between FP 1.5.18 and FP 1.5.20 (SourceForge file section has no FP 1.5.19.). The fix involved creating the new class LocalEntityResolver that extended NanoXML/Java's XMLEntityResolver class by overriding the method openExternalEntity() to throw XMLParseException with the message "External entities are not allowed" and other changes.
Unlike NanoXML/Java, FreeMind's NanoXML/Lite has no XMLEntityResolver class and no ability to "open" external entities.
The mind map parsing security issue, impacting Freeplane 1.5.18 and some of its eariler versions, does not impact FreeMind 1.0.1. The issue does not impact FreeMind 0.7.1, FreeMind 0.8.1 and FreeMind 0.9.0 either.
Log in to post a comment.