CVE-2021-23792 XML External Entity (XXE) Injection
An attacker can trigger XML External Entity injection by supplying a malicious image file with crafted XMP metadata, potentially leading to data exposure or service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23792?
CVE-2021-23792 is a high-severity vulnerability in com.twelvemonkeys.imageio:imageio-metadata, published on 6 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.
Weakness: CWE-611
Which versions are affected by CVE-2021-23792?
2 open source packages ship an affected version, including com.twelvemonkeys.imageio:imageio-metadata. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.twelvemonkeys.imageio:imageio-metadata Maven | All versions | 3.7.1 |
com.twelvemonkeys.imageio:imageio-metadata Maven | All versions | 3.7.1 |
Products include Twelvemonkeys Project Twelvemonkeys.
How do I fix CVE-2021-23792?
Upgrade com.twelvemonkeys.imageio:imageio-metadata to 3.7.1 or later.
Is CVE-2021-23792 being exploited?
There is no known exploitation of CVE-2021-23792 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2021-23792, GHSA-pjch-4g28-fxx7, SNYK-JAVA-COMTWELVEMONKEYSIMAGEIO-2316763, UBUNTU-CVE-2021-23792.