Vulnerability · Published Nov 8, 2024 · Assigned by GitHub_M
CVE-2024-52007XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`
High 8.6
In plain English
A high-severity XML external entity in org.hl7.fhir.core from hapifhir. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 & #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may | 6.4.0 | GHSA-gr3c-q7xf-47vh |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 | 6.4.0 | GHSA-gr3c-q7xf-47vh |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4 | 6.4.0 | GHSA-gr3c-q7xf-47vh |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4b | 6.4.0 | GHSA-gr3c-q7xf-47vh |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r5 | 6.4.0 | GHSA-gr3c-q7xf-47vh |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.utilities | 6.4.0 | GHSA-gr3c-q7xf-47vh |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hapifhir | org.hl7.fhir.core | < 6.4.0 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gr3c-q7xf-47vh x_refsource_CONFIRM
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf x_refsource_MISC
- https://github.com/hapifhir/org.hl7.fhir.core/issues/1571 x_refsource_MISC
- https://github.com/hapifhir/org.hl7.fhir.core/pull/1717 x_refsource_MISC
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j x_refsource_MISC
- https://cwe.mitre.org/data/definitions/611.html x_refsource_MISC