PT-2018-9564 · Processing · Processing

Publicado 2018-12-20 · Atualizado 2019-02-07 · CVE-2018-1000840

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Processing version 3.4 and earlier

Description The issue concerns a XML External Entity (XXE) vulnerability in the loadXML() function. This vulnerability allows an attacker to read arbitrary files and exfiltrate their contents via HTTP requests. The attack is exploitable when the victim uses Processing to parse a crafted XML document.

Recommendations For Processing version 3.4 and earlier, as a temporary workaround, consider disabling the loadXML() function until a patch is available. Restrict access to sensitive files and minimize the use of Processing for parsing untrusted XML documents to reduce the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-1000840

Produtos afetados

Processing

Referências · 7

• 🔥 https://github.com/processing/processing/issues/5706 · Exploit
• https://osv.dev/vulnerability/CVE-2018-1000840 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000840 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-1000840 · Nota de Segurança
• https://twitter.com/ben_fry/status/1054333613465059329 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000840 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-1000840 · Aviso do Fabricante