Lucene search

GitHub_MCVE-2024-46984

HistorySep 19, 2024 - 11:15 p.m.

CVE-2024-46984

2024-09-1923:15:12

CWE-611

GitHub_M

web.nvd.nist.gov

fhir resources

xml external entities

server side request forgery

reference validator

woodstox wstxinputfactory

cve-2024-46984

vulnerability

patch

update

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

45.1%

JSON

The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to XML External Entities attack due to insecure defaults of the used Woodstox WstxInputFactory. A malicious XML resource can lead to network requests issued by referencevalidator and thus to a Server Side Request Forgery attack. The vulnerability impacts applications which use referencevalidator to process XML resources from untrusted sources. The problem has been patched with the 2.5.1 version of the referencevalidator. Users are strongly recommended to update to this version or a more recent one. A pre-processing or manual analysis of input XML resources on existence of DTD definitions or external entities can mitigate the problem.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

gematikreference_validatorRange<2.5.1

VendorProductVersionCPE
gematikreference_validator*cpe:2.3:a:gematik:reference_validator:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gematik	reference_validator	*	cpe:2.3:a:gematik:reference_validator::::::::

CNA Affected

[
  {
    "vendor": "gematik",
    "product": "app-referencevalidator",
    "versions": [
      {
        "version": "< 2.5.1",
        "status": "affected"
      }
    ]
  }
]

References

cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory

github.com/gematik/app-referencevalidator/releases/tag/2.5.1

github.com/gematik/app-referencevalidator/security/advisories/GHSA-68j8-fp38-p48q

owasp.org/www-community/attacks/Server_Side_Request_Forgery

owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)

owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)#

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

45.1%

JSON

Related for CVE-2024-46984