CVE-2023-28465 HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
Attackers can copy arbitrary files to directories via path traversal in HL7 FHIR Core Libraries package decompression.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28465?
CVE-2023-28465 is a high-severity path traversal vulnerability in n/a, published on 12 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists because of an incomplete fix for CVE-2023-24057.
Weakness: CWE-22
Which versions are affected by CVE-2023-28465?
12 open source packages ship an affected version, including ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.core and ca.uhn.hapi.fhir:org.hl7.fhir.r4b. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ca.uhn.hapi.fhir:org.hl7.fhir.convertors Maven | All versions | 5.6.106 |
ca.uhn.hapi.fhir:org.hl7.fhir.convertors Maven | All versions | 5.6.106 |
ca.uhn.hapi.fhir:org.hl7.fhir.core Maven | All versions | 5.6.106 |
ca.uhn.hapi.fhir:org.hl7.fhir.core Maven | All versions | 5.6.106 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4b Maven | All versions | 5.6.106 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4b Maven | All versions | 5.6.106 |
6 more packages
ca.uhn.hapi.fhir:org.hl7.fhir.r5 Maven | All versions | 5.6.106 |
ca.uhn.hapi.fhir:org.hl7.fhir.r5 Maven | All versions | 5.6.106 |
ca.uhn.hapi.fhir:org.hl7.fhir.utilities Maven | All versions | 5.6.106 |
ca.uhn.hapi.fhir:org.hl7.fhir.utilities Maven | All versions | 5.6.106 |
ca.uhn.hapi.fhir:org.hl7.fhir.validation Maven | All versions | 5.6.106 |
ca.uhn.hapi.fhir:org.hl7.fhir.validation Maven | All versions | 5.6.106 |
Products include Hapifhir Hl7 Fhir Core.
How do I fix CVE-2023-28465?
Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.convertors to 5.6.106 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-28465 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-28465 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2026-34361 HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
- CVE-2026-55471 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
- CVE-2023-24057 MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`
- CVE-2026-55470 HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
- CVE-2026-34359 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core
Sources
Also known as GHSA-9654-pr4f-gh6m.