PT-2020-13180 · Unknown · Service-Api

Julien M · Published 2020-05-04 · Updated 2021-08-13 · CVE-2020-12642

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions service-api versions 3.1.0 through 4.3.11 service-api versions 5.0.0 through 5.1.0

Description An issue in service-api allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import. This is due to the XML parser not being configured properly to prevent XML external entity (XXE) attacks, allowing a user to import a specifically-crafted XML file for extraction of secrets or server-side request forgery.

Recommendations For service-api versions 3.1.0 through 4.3.11, update to version 4.3.12 or later. For service-api versions 5.0.0 through 5.1.0, update to version 5.1.1 or later. As a temporary workaround, consider disabling the JUnit XML launch import feature until a patch is available. Restrict access to the XML parser to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-12642

GHSA-2JX8-V4HV-GX3H

GHSA-7QFM-6M33-RGG9

Affected Products

Service-Api

References · 10

• https://github.com/reportportal/reportportal/blob/master/SECURITY_ADVISORIES.md · Patch
• https://osv.dev/vulnerability/GHSA-7qfm-6m33-rgg9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12642 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12642 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2jx8-v4hv-gx3h · Vendor Advisory
• https://github.com/reportportal/reportportal/security/advisories/GHSA-2jx8-v4hv-gx3h · Note
• https://github.com/reportportal/reportportal · Note
• https://github.com/reportportal/service-api/pull/1201 · Note
• https://github.com/reportportal/service-api/commit/da4a012abdcc69f02f4255d81466f1f473b7f418 · Note
• https://t.me/cvenotify/3535 · Telegram Post