PT-2023-28345 · Gradle+1 · Gradle+1

Ljacomet · Publicado 2023-10-06 · Atualizado 2024-03-06 · CVE-2023-42445

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Gradle versions prior to 7.6.3 Gradle versions prior to 8.4

Description Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes, including Ivy XML descriptors and Maven POM files that can be fetched from remote repositories.

Recommendations For versions prior to 7.6.3, update to Gradle 7.6.3 or later to disable resolving XML external entities. For versions prior to 8.4, update to Gradle 8.4 or later to disable resolving XML external entities. As a temporary workaround, consider disabling the parsing of XML files that have XML external entities until a patch is available.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BIT-GRADLE-2023-42445

CVE-2023-42445

GHSA-MRFF-Q8QJ-XVG8

Produtos afetados

Debian

Gradle

Referências · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42445.json · Exploit
• https://github.com/gradle/gradle/releases/tag/v8.4.0 · Nota
• https://github.com/gradle/gradle/releases/tag/v7.6.3 · Nota
• https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-42445 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-gradle-2023-42445 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-42445 · Aviso do Fabricante
• https://t.me/cibsecurity/71733 · Publicação no Telegram
• https://osv.dev/vulnerability/BELL-CVE-2023-42445 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1710297802956304821 · Publicação no Twitter
• https://security.netapp.com/advisory/ntap-20231110-0006 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-42445 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-42445 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1710338310453760351 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-42445 · Aviso do Fabricante