PT-2023-5313 · Eclipse · Eclipse Leshan

Jaroslawlegierski · Published 2023-08-31 · Updated 2023-09-06 · CVE-2023-41034

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Eclipse Leshan versions prior to 1.5.0 Eclipse Leshan versions prior to 2.0.0-M13

Description The issue is related to the incorrect restriction of XML links to external objects, which can allow a remote attacker to perform an XXE attack. This affects the DDFFileParser and DefaultDDFFileValidator (and so ObjectLoader) components. Users are impacted only if they parse untrusted DDF files. A DDF file is a LWM2M format used to store LWM2M object descriptions.

Recommendations For versions prior to 1.5.0, upgrade to version 1.5.0 or later. For versions prior to 2.0.0-M13, upgrade to version 2.0.0-M13 or later. As a temporary workaround, consider creating a DocumentBuilderFactory with secure processing features, such as setting FEATURE SECURE PROCESSING to true, disabling DTDs, and disabling XML inclusions. Additionally, for DefaultDDFFileValidator, set FEATURE SECURE PROCESSING to true and restrict access to external DTDs and schemas.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2023-05939

CVE-2023-41034

GHSA-WC9J-GC65-3CM7

Affected Products

Eclipse Leshan

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41034.json · Exploit
• https://github.com/eclipse-leshan/leshan/commit/4d3e63ac271a817f81fba3e3229c519af7a3049c · Patch
• https://github.com/eclipse-leshan/leshan/commit/29577d2879ba8e7674c3b216a7f01193fc7ae013 · Patch
• https://osv.dev/vulnerability/GHSA-wc9j-gc65-3cm7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41034 · Security Note
• https://bdu.fstec.ru/vul/2023-05939 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41034 · Vendor Advisory
• https://github.com/eclipse-leshan/leshan/security/advisories/GHSA-wc9j-gc65-3cm7 · Note
• https://github.com/eclipse-leshan/leshan/wiki/Adding-new-objects#the-lwm2m-model · Note
• https://github.com/eclipse-leshan/leshan · Note
• https://t.me/cibsecurity/69585 · Telegram Post
• https://vuldb.com/ru/?id.238523 · Note
• https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing · Note