PT-2023-5313 · Eclipse · Eclipse Leshan

Jaroslawlegierski · Publicado 2023-08-31 · Atualizado 2023-09-06 · CVE-2023-41034

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Eclipse Leshan versions prior to 1.5.0 Eclipse Leshan versions prior to 2.0.0-M13

Description The issue is related to the incorrect restriction of XML links to external objects, which can allow a remote attacker to perform an XXE attack. This affects the DDFFileParser and DefaultDDFFileValidator (and so ObjectLoader) components. Users are impacted only if they parse untrusted DDF files. A DDF file is a LWM2M format used to store LWM2M object descriptions.

Recommendations For versions prior to 1.5.0, upgrade to version 1.5.0 or later. For versions prior to 2.0.0-M13, upgrade to version 2.0.0-M13 or later. As a temporary workaround, consider creating a DocumentBuilderFactory with secure processing features, such as setting FEATURE SECURE PROCESSING to true, disabling DTDs, and disabling XML inclusions. Additionally, for DefaultDDFFileValidator, set FEATURE SECURE PROCESSING to true and restrict access to external DTDs and schemas.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2023-05939

CVE-2023-41034

GHSA-WC9J-GC65-3CM7

Produtos afetados

Eclipse Leshan

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41034.json · Exploit
• https://github.com/eclipse-leshan/leshan/commit/4d3e63ac271a817f81fba3e3229c519af7a3049c · Correção
• https://github.com/eclipse-leshan/leshan/commit/29577d2879ba8e7674c3b216a7f01193fc7ae013 · Correção
• https://github.com/eclipse-leshan/leshan/security/advisories/GHSA-wc9j-gc65-3cm7 · Nota
• https://github.com/eclipse-leshan/leshan/wiki/Adding-new-objects#the-lwm2m-model · Nota
• https://github.com/eclipse-leshan/leshan · Nota
• https://t.me/cibsecurity/69585 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-wc9j-gc65-3cm7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-41034 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-05939 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-41034 · Aviso do Fabricante
• https://vuldb.com/ru/?id.238523 · Nota
• https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing · Nota