[Security] Learning Hub content.xml parsed with XXE-enabled XmlDocument #47

Severity: CVSS 5.9 (Medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N · MSRC Moderate
Attacker: network MITM / hijacked feed · Metalama analogue: closest metalama/Metalama#1649

Affected code

• UserInterface/PostSharp.VisualStudio/View/LearningHub/ContentDownloader.cs:72-83 (and the cached re-parse at :26-29)

Description

content.xml (downloaded from the Learning Hub feed) is parsed by a bare XmlDocument with no XmlResolver = null / DtdProcessing restriction; on .NET Framework 4.7.2 the default XmlUrlResolver resolves DTDs/external entities → XXE (local file disclosure / SSRF) when the feed content is attacker-controlled. CA3075 is globally disabled.

Exploit scenario

A hijacked feed server, or an active TLS-MITM with a valid cert for www.postsharp.net, returns a content.xml whose DTD exfiltrates a local file or forces internal requests; resolved as the developer when the Learning Hub tool window loads. (The feed is HTTPS, so passive MITM is blocked.)

Recommendation

Set document.XmlResolver = null (and DtdProcessing = Prohibit) before both Load calls.

Severity notes

Most debatable: AC — H because the attacker must control the trusted HTTPS server; if you score the XXE itself (conditioned on a compromised feed) as trivially reliable, AC:L → 8.2 High.

Part of #56.