http4s-scala-xml has an XML External Entity (XXE) processing issue
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.24.1, 1.0.0-M39
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Versions 0.24.1 and 1.0.0-M39 fix the issue.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- http4s http4s-scala-xml
fixed in 0.24.1; From 1.0.0-M1 · fixed in 1.0.0-M39
- org.http4s:http4s-scala-xml_2.12Maven
fixed in 0.24.1
- org.http4s:http4s-scala-xml_2.13Maven
fixed in 0.24.1
- org.http4s:http4s-scala-xml_2.13Maven
From 1.0.0-M1 · fixed in 1.0.0-M39
- org.http4s:http4s-scala-xml_3Maven
fixed in 0.24.1
- org.http4s:http4s-scala-xml_3Maven
From 1.0.0-M1 · fixed in 1.0.0-M39