PT-2018-9564 · Processing · Processing

Published 2018-12-20 · Updated 2019-02-07 · CVE-2018-1000840

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Processing version 3.4 and earlier

Description The issue concerns a XML External Entity (XXE) vulnerability in the loadXML() function. This vulnerability allows an attacker to read arbitrary files and exfiltrate their contents via HTTP requests. The attack is exploitable when the victim uses Processing to parse a crafted XML document.

Recommendations For Processing version 3.4 and earlier, as a temporary workaround, consider disabling the loadXML() function until a patch is available. Restrict access to sensitive files and minimize the use of Processing for parsing untrusted XML documents to reduce the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-1000840

Affected Products

Processing

References · 7

• 🔥 https://github.com/processing/processing/issues/5706 · Exploit
• https://osv.dev/vulnerability/CVE-2018-1000840 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000840 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1000840 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000840 · Security Note
• https://ubuntu.com/security/CVE-2018-1000840 · Vendor Advisory
• https://twitter.com/ben_fry/status/1054333613465059329 · Note