PT-2023-28345 · Gradle+1 · Gradle+1

Ljacomet · Published 2023-10-06 · Updated 2024-03-06 · CVE-2023-42445

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Gradle versions prior to 7.6.3 Gradle versions prior to 8.4

Description Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes, including Ivy XML descriptors and Maven POM files that can be fetched from remote repositories.

Recommendations For versions prior to 7.6.3, update to Gradle 7.6.3 or later to disable resolving XML external entities. For versions prior to 8.4, update to Gradle 8.4 or later to disable resolving XML external entities. As a temporary workaround, consider disabling the parsing of XML files that have XML external entities until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BIT-GRADLE-2023-42445

CVE-2023-42445

GHSA-MRFF-Q8QJ-XVG8

Affected Products

Debian

Gradle

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42445.json · Exploit
• https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-42445 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gradle-2023-42445 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-42445 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-42445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42445 · Security Note
• https://ubuntu.com/security/CVE-2023-42445 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42445 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-42445 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-42445 · Vendor Advisory
• https://github.com/gradle/gradle/releases/tag/v8.4.0 · Note
• https://github.com/gradle/gradle/releases/tag/v7.6.3 · Note
• https://t.me/cibsecurity/71733 · Telegram Post
• https://twitter.com/CVEnew/status/1710297802956304821 · Twitter Post