PT-2024-27967 · Unknown · Cyclonedx-Core-Java

Mr-Zepol · Published 2024-06-24 · Updated 2025-11-11 · CVE-2024-38374

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions cyclonedx-core-java versions prior to 9.0.4

Description The CycloneDX core module provides a model representation of SBOMs and utilities for creating, validating, and parsing them. Before deserializing CycloneDX Bill of Materials in XML format, cyclonedx-core-java uses XPath expressions to determine the schema version. The DocumentBuilderFactory used to evaluate these XPath expressions was not configured securely, leading to a potential XML External Entity (XXE) injection issue. XXE injection can be exploited to extract local file content or perform Server Side Request Forgery (SSRF) to access adjacent infrastructure. The provided Proof of Concept (PoC) demonstrates the potential for a connection error when attempting to access a non-existent file via a crafted XML document.

Recommendations Update cyclonedx-core-java to version 9.0.4 or later.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-38374

GHSA-683X-4444-JXH8

Affected Products

Cyclonedx-Core-Java

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38374.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-38374 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-683x-4444-jxh8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38374 · Security Note
• https://github.com/CycloneDX/cyclonedx-core-java · Note
• https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d · Note
• https://github.com/CycloneDX/cyclonedx-core-java/pull/434 · Note
• https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8 · Note
• https://t.me/cvenotify/84823 · Telegram Post
• https://twitter.com/dailycve/status/1987997092866834516 · Twitter Post
• https://twitter.com/gN3mes1s/status/1988228632116883535 · Twitter Post