Vulners
Lucene search
iText PDF Library 7.0.2 / 5.5.11 / 2.0.8 XXE Injection Vulnerability
| Reporter | Title | Published | Views | Family All 18 |
|---|---|---|---|---|
 | Security Bulletin: IBM Daeja ViewONE Virtual 5.0.14 iFix 5 addresses CVE-2017-9096 | 14 Oct 202405:58 | – | ibm |
| Security Bulletin: iText.jar in Tom Sawyer Perspective is vulnerable to XML External Entity | 21 Apr 202307:19 | – | ibm |
| Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions | 14 Apr 202615:53 | – | ibm |
 | The vulnerability of XML parser components in the iText software development tool allows attackers to execute XXE attacks. | 11 Apr 202500:00 | – | bdu_fstec |
 | iText XML External Entity Vulnerability | 7 Nov 201700:00 | – | cnvd |
 | CVE-2017-9096 | 8 Nov 201716:00 | – | cve |
 | CVE-2017-9096 | 8 Nov 201716:00 | – | cvelist |
 | EUVD-2022-3126 | 8 Nov 201716:00 | – | euvd |
 | Improper Restriction of XML External Entity Reference in iText | 13 May 202201:14 | – | github |
 | CVE-2017-9096 | 8 Nov 201716:29 | – | nvd |
10
##################################################################
#
# Product: iText PDF Library
# Vendor: iText Group
# CVE ID: CVE-2017-9096
# Subject: XML External Entity Attack (XXE)
# Risk: Medium
# Effect: Remotely exploitable
# Author: Benjamin Bruppacher <[email protected]>
# Date: 2017-11-06
#
##################################################################
Introduction:
-------------
iText is a software developer toolkit that allows users to integrate PDF functionalities within their applications, processes or products.
The used XML parsers inside the library are not configured to disable external entities. This can be used for XML External Entity Attacks[1].
Affected versions:
---------
Vulnerable:
* 2.0.8
* 5.5.11
* 7.0.2
Not vulnerable:
* 5.5.12
* 7.0.3
Technical Description
---------------------
The attack can be carried out by submitting a malicious PDF to an iText application that parses XML data.
By providing a malicious XXE payloads inside the XML data that resides in the PDF, an attacker can for example extract files or forge requests on the server.
Timeline:
---------
2017-05-10: Discovery by Benjamin Bruppacher
2017-05-15: Initial vendor notification
2017-08-01: Vendor releases patch
2017-11-06: Disclosure of the advisory
References:
-----------
[1] https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
# 0day.today [2018-03-01] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
09 Nov 2017 00:00Current
0.2Low risk
Vulners AI Score0.2
EPSS0.07637