PT-2024-32318 · Unknown · Referencevalidator+1

Alexey-Tschudnowsky · Published 2024-09-19 · Updated 2024-09-25 · CVE-2024-46984

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions referencevalidator versions prior to 2.5.1

Description The profile location routine in the referencevalidator commons package is vulnerable to XML External Entities attack due to insecure defaults of the used Woodstox WstxInputFactory. A malicious XML resource can lead to network requests issued by referencevalidator and thus to a Server Side Request Forgery attack. The vulnerability impacts applications which use referencevalidator to process XML resources from untrusted sources.

Recommendations For versions prior to 2.5.1, update to version 2.5.1 or a more recent one to resolve the issue. As a temporary workaround, consider pre-processing or manual analysis of input XML resources for existence of DTD definitions or external entities to mitigate the problem.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-46984

GHSA-68J8-FP38-P48Q

Affected Products

Woodstox Wstxinputfactory

Referencevalidator

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46984.json · Exploit
• https://github.com/gematik/app-referencevalidator/security/advisories/GHSA-68j8-fp38-p48q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46984 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46984 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-68j8-fp38-p48q · Vendor Advisory
• https://github.com/gematik/app-referencevalidator/releases/tag/2.5.1 · Note
• https://github.com/gematik/app-referencevalidator · Note
• https://github.com/gematik/app-referencevalidator/commit/d6d27613fab7a8dd08534946f29e0c51f319cad6 · Note
• https://twitter.com/CVEnew/status/1836900982296543621 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1837051023338135886 · Twitter Post
• https://owasp.org/www-community/attacks/Server_Side_Request_Forgery · Note
• https://t.me/cvenotify/95375 · Telegram Post
• https://twitter.com/CveFindCom/status/1836903586007032094 · Twitter Post
• https://t.me/cvedetector/6081 · Telegram Post
• https://twitter.com/cracbot/status/1838458418119741643 · Twitter Post