PT-2024-31547 · Unknown · Hl7 Fhir Core Artifacts

Qligier · Published 2024-09-06 · Updated 2024-09-06 · CVE-2024-45294

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HL7 FHIR Core Artifacts repository versions prior to 6.3.23

Description The issue concerns XML external entity injections in XSLT transforms performed by various components. A processed XML file with a malicious DTD tag could produce XML containing data from the host system, impacting use cases where external clients can submit XML. This affects scenarios where the repository is used within a host that allows external client XML submissions.

Recommendations For versions prior to 6.3.23, update to release 6.3.23 to resolve the issue. As a temporary workaround, consider restricting the submission of XML files from external clients until the update is applied. Avoid using the <!DOCTYPE> tag with external entities in XML files until the issue is resolved. At the moment, there are no other known workarounds available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-45294

GHSA-59RQ-22FM-X8Q5

GHSA-6CR6-PH3P-F5RF

Affected Products

Hl7 Fhir Core Artifacts

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45294.json · Exploit
• https://osv.dev/vulnerability/GHSA-6cr6-ph3p-f5rf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45294 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45294 · Vendor Advisory
• https://github.com/hapifhir/org.hl7.fhir.core · Note
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf · Note
• https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23 · Note
• https://github.com/HL7/fhir-ig-publisher/releases/tag/1.6.22 · Note
• https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5 · Note
• https://twitter.com/CveFindCom/status/1832086719945990298 · Twitter Post
• https://t.me/cvedetector/4975 · Telegram Post
• https://twitter.com/CVEnew/status/1832091387229303081 · Twitter Post
• https://t.me/cvedetector/4983 · Telegram Post