PT-2024-25802 · Unknown · Cyclonedx Javascript Library

Jkowalleck · Published 2024-05-08 · Updated 2024-05-18 · CVE-2024-34345

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CycloneDX JavaScript library version 6.7.0

Description The CycloneDX JavaScript library is vulnerable to XML External Entity (XXE) injections when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1. To exploit this, an attacker could craft a malicious XML input that includes an external entity, potentially leading to unintended behavior. For example, an attacker could use the XmlValidator function to validate a forged input, such as the one shown in the proof-of-concept code, which includes an XML external entity injection. The validator.validate(input) function would then process this input, potentially taking the external entity into account.

Recommendations For version 6.7.0, update to version 6.7.1 to fix the issue. As a temporary workaround, do not run the provided XML validator on untrusted inputs.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-34345

GHSA-38GF-RH2W-GMJ7

Affected Products

Cyclonedx Javascript Library

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34345.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34345 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34345 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-38gf-rh2w-gmj7 · Vendor Advisory
• https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063 · Note
• https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7 · Note
• https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203 · Note
• https://github.com/CycloneDX/cyclonedx-javascript-library · Note
• https://twitter.com/cracbot/status/1791710436230103437 · Twitter Post
• https://twitter.com/cracbot/status/1792072821793071166 · Twitter Post