Tolgee is an open-source localization platform. Teams upload translation files in formats like Android XML, XLIFF, .resx, and Apple stringsdict. Every one of those formats is XML.

When I see an app that parses user-uploaded XML server-side, the first thing I check is whether the parser disables external entity resolution. In Java, XMLInputFactory and DocumentBuilderFactory ship with dangerous defaults: external entities are enabled out of the box.

I cloned the repo and grepped for those two classes. Six results. None of them had any security configuration.

The exploit is simple. Upload an Android XML translation file like this:

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE resources [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <resources> <string name= "test_key" > &xxe; </string> </resources>

The parser resolves &xxe;, reads /etc/passwd, and returns the contents as the translation value. I confirmed this on Tolgee's own cloud platform at app.tolgee.io.…