Publish GHSA-683x-4444-jxh8

2026-05-22 18:04:22 -07:00 · 2024-06-24 20:45:57 +00:00
parent 06278f8de2
commit 9376c16453
1 changed files with 57 additions and 0 deletions
@@ -0,0 +1,57 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-683x-4444-jxh8",
+  "modified": "2024-06-24T20:44:48Z",
+  "published": "2024-06-24T20:44:48Z",
+  "aliases": [
+    "CVE-2024-38374"
+  ],
+  "summary": "Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java",
+  "details": "### Impact\n\nBefore deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection.\n\nXXE injection can be exploited to exfiltrate local file content, or perform Server Side Request Forgery (SSRF) to access infrastructure adjacent to the vulnerable application.\n\n### PoC\n\n```java\nimport org.cyclonedx.parsers.XmlParser;\n\nclass Poc {\n\n    public static void main(String[] args) {\n        // Will throw org.cyclonedx.exception.ParseException: java.net.ConnectException: Connection refused\n        new XmlParser().parse(\"\"\"\n            <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n            <!DOCTYPE bom [<!ENTITY % sp SYSTEM \"https://localhost:1010/does-not-exist/file.dtd\"> %sp;]>\n            <bom xmlns=\"http://cyclonedx.org/schema/bom/1.5\"/>\n            \"\"\".getBytes());\n    }\n\n}\n```\n\n### Patches\n\nThe vulnerability has been fixed in _cyclonedx-core-java_ version 0.9.4.\n\n### Workarounds\n\nIf feasible, applications can reject XML documents before handing them to _cyclonedx-core-java_ for parsing.\nThis may be an option if incoming CycloneDX BOMs are known to be in JSON format.\n\n### References\n\n* Issue was fixed via <https://github.com/CycloneDX/cyclonedx-core-java/pull/434>\n* Issue was introduced via <https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9>\n* <https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing>\n* <https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xpathexpression>\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.cyclonedx:cyclonedx-core-java"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.1.0"
+            },
+            {
+              "fixed": "9.0.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/CycloneDX/cyclonedx-core-java"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-611"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-06-24T20:44:48Z",
+    "nvd_published_at": null
+  }
+}