PT-2021-18371 · Unknown · Report Portal Service-Api

Published 2021-06-23 · Updated 2021-06-30 · CVE-2021-29620

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Report Portal service-api versions 3.1.0 through 5.3.x

Description The issue concerns an XML external entity (XXE) attack vulnerability. It allows a user to import a specifically-crafted XML file, which can import external Document Type Definition (DTD) files with external entities. This can lead to the extraction of secrets from the Report Portal service-api module or enable server-side request forgery. The vulnerability was introduced starting from version 3.1.0 of the service-api when XML parsing was added.

Recommendations For versions 3.1.0 through 5.3.x, update to version 5.4.0 to resolve the issue. As a temporary workaround, consider disabling the XML parsing feature in the service-api module until the update to version 5.4.0 is applied. Restrict access to the service-api module to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-29620

GHSA-24WF-7VF2-PV59

Affected Products

Report Portal Service-Api

References · 8

• https://github.com/reportportal/reportportal/security/advisories/GHSA-24wf-7vf2-pv59 · Patch
• https://github.com/reportportal/service-api/pull/1392 · Patch
• https://osv.dev/vulnerability/CVE-2021-29620 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-24wf-7vf2-pv59 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29620 · Security Note
• https://github.com/reportportal/service-api/commit/a73e0dfb4eda844c37139df1f9847013d55f084e · Note
• https://mvnrepository.com/artifact/com.epam.reportportal/service-api · Note
• https://t.me/cvenotify/16870 · Telegram Post