security.snyk.io Open in urlscan Pro
2600:1408:ac00:29b::ecd  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Developer Tools
 * Snyk Learn
 * Snyk Advisor
 * Code Checker

About Snyk
 1. Snyk Vulnerability Database
 2. Maven
 3. org.apache.xmlbeans:xmlbeans




XML EXTERNAL ENTITY (XXE) INJECTION AFFECTING ORG.APACHE.XMLBEANS:XMLBEANS
PACKAGE, VERSIONS [,3.0.0)

--------------------------------------------------------------------------------

SEVERITY

Recommended
8.3
high
0
10

CVSS ASSESSMENT MADE BY SNYK'S SECURITY TEAM

Learn more


THREAT INTELLIGENCE



EPSS
0.37% (73rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components
are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about XML External Entity (XXE) Injection vulnerabilities in an
interactive lesson.

Start learning
 * Snyk ID SNYK-JAVA-ORGAPACHEXMLBEANS-1060048
 * published 14 Jan 2021
 * disclosed 14 Jan 2021
 * credit PJ Fanning

Report a new vulnerability Found a mistake?

INTRODUCED: 14 JAN 2021

CVE-2021-23926 Open this link in a new tab

CWE-611 Open this link in a new tab

Share



HOW TO FIX?

Upgrade org.apache.xmlbeans:xmlbeans to version 3.0.0 or higher.


OVERVIEW

Affected versions of this package are vulnerable to XML External Entity (XXE)
Injection. The XML parsers used by XMLBeans did not set the properties needed to
protect the user from malicious XML input. Vulnerabilities include possibilities
for XML Entity Expansion attacks.


DETAILS

XXE Injection is a type of attack against an application that parses XML input.
XML is a markup language that defines a set of rules for encoding documents in a
format that is both human-readable and machine-readable. By default, many XML
processors allow specification of an external entity, a URI that is dereferenced
and evaluated during XML processing. When an XML document is being parsed, the
parser can make a request and include the content at the specified URI inside of
the XML document.

Attacks can include disclosing local files, which may contain sensitive data
such as passwords or private user data, using file: schemes or relative paths in
the system identifier.

For example, below is a sample XML document, containing an XML element-
username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>


An external XML entity - xxe, is defined using a system identifier and present
within a DOCTYPE header. These entities can access local or remote content. For
example the below code contains an external XML entity that would fetch the
content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>


Other XXE Injection attacks can access local resources that may not stop
returning data, possibly impacting application availability and leading to
Denial of Service.


REFERENCES

 * Apache CVE Announcement
 * GitHub Release
 * JIra Issue


CVSS SCORES

version 3.1
Expand this section


SNYK

8.3 high
 * Attack Vector (AV)
   Network
 * Attack Complexity (AC)
   Low
 * Privileges Required (PR)
   None
 * User Interaction (UI)
   None

 * Scope (S)
   Changed

 * Confidentiality (C)
   Low
 * Integrity (I)
   Low
 * Availability (A)
   Low

Expand this section


NVD

9.1 critical
Expand this section


SUSE

7.4 high


PRODUCT

 * Snyk Open Source
 * Snyk Code
 * Snyk Container
 * Snyk Infrastructure as Code
 * Test with Github
 * Test with CLI


RESOURCES

 * Vulnerability DB
 * Documentation
 * Disclosed Vulnerabilities
 * Blog
 * FAQs


COMPANY

 * About
 * Jobs
 * Contact
 * Policies
 * Do Not Sell My Personal Information


CONTACT US

 * Support
 * Report a new vuln
 * Press Kit
 * Events


FIND US ONLINE

 * 
 * 
 * 
 * 


TRACK OUR DEVELOPMENT

 * 
 * 



© 2024 Snyk Limited

Registered in England and Wales. Company number: 09677925

Registered address: Highlands House, Basingstoke Road, Spencers Wood, Reading,
Berkshire, RG7 1NT.