Lucene search

GitHub_MVULNRICHMENT:CVE-2024-46984

HistorySep 19, 2024 - 10:38 p.m.

CVE-2024-46984 XML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidator

2024-09-1922:38:21

CWE-611

GitHub_M

github.com

cve-2024-46984

server side request forgery

fhir resources

ti applications

interoperability standards

woodstox wstxinputfactory

network requests

patched

update

dtd definitions

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

45.1%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to XML External Entities attack due to insecure defaults of the used Woodstox WstxInputFactory. A malicious XML resource can lead to network requests issued by referencevalidator and thus to a Server Side Request Forgery attack. The vulnerability impacts applications which use referencevalidator to process XML resources from untrusted sources. The problem has been patched with the 2.5.1 version of the referencevalidator. Users are strongly recommended to update to this version or a more recent one. A pre-processing or manual analysis of input XML resources on existence of DTD definitions or external entities can mitigate the problem.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:gematik:app-referencevalidator:*:*:*:*:*:*:*:*"
    ],
    "vendor": "gematik",
    "product": "app-referencevalidator",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.5.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory

github.com/gematik/app-referencevalidator/releases/tag/2.5.1

github.com/gematik/app-referencevalidator/security/advisories/GHSA-68j8-fp38-p48q

owasp.org/www-community/attacks/Server_Side_Request_Forgery

owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)

owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)#

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

45.1%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-46984