PT-2024-35091 · Hapi Fhir · Hapi Fhir

Dotasek · Published 2024-09-06 · Updated 2024-11-12 · CVE-2024-52007

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.4.0

Description The XSLT parsing performed by various components in HAPI FHIR is vulnerable to XML external entity injections. This issue can be exploited by submitting a malicious XML file with a DTD tag, potentially allowing access to data from the host system. This vulnerability impacts use cases where org.hl7.fhir.core is being used within a host where external clients can submit XML. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 6.4.0, upgrade to release version 6.4.0 to address the issue. As a temporary workaround, consider restricting access to the XSLT parsing components to minimize the risk of exploitation. Avoid using the org.hl7.fhir.core component in environments where external clients can submit XML until the issue is resolved. At the moment, there are no known workarounds for this vulnerability other than upgrading to the fixed version.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-52007

GHSA-6CR6-PH3P-F5RF

GHSA-GR3C-Q7XF-47VH

Affected Products

Hapi Fhir

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52007.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-52007 · Security Note
• https://osv.dev/vulnerability/GHSA-6cr6-ph3p-f5rf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45294 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52007 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gr3c-q7xf-47vh · Vendor Advisory
• https://github.com/hapifhir/org.hl7.fhir.core · Note
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gr3c-q7xf-47vh · Note
• https://github.com/hapifhir/org.hl7.fhir.core/issues/1571 · Note
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf · Note
• https://github.com/hapifhir/org.hl7.fhir.core/pull/1717 · Note
• https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23 · Note
• https://github.com/HL7/fhir-ig-publisher/releases/tag/1.6.22 · Note
• https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5 · Note
• https://cwe.mitre.org/data/definitions/611.html · Note