CycloneDX core Java Library XXE via Unsafe XPath (v<9.0.4)
CVE-2024-38374 Published on June 28, 2024
Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.
Vulnerability Analysis
CVE-2024-38374 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is a XXE Vulnerability?
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVE-2024-38374 has been classified to as a XXE vulnerability or weakness.
Affected Versions
cyclonedx-core-java:- Version >= 2.1.0, < 9.0.4 is affected.
- Version 2.1.0 and below 9.0.4 is affected.
Vulnerable Packages
The following package name and versions may be associated with CVE-2024-38374
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| maven | org.cyclonedx:cyclonedx-core-java | >= 2.1.0, < 11.0.1 | 11.0.1 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.