CVE-2024-38374 Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java
Attackers can exploit insecure XML parsing in CycloneDX Java library to read sensitive files or cause denial of service via XXE injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38374?
CVE-2024-38374 is a high-severity vulnerability in cyclonedx-core-java, published on 28 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.
Weakness: CWE-611
Which versions are affected by CVE-2024-38374?
2 open source packages ship an affected version, including org.cyclonedx:cyclonedx-core-java.
| Package | Affected | Fixed in |
|---|---|---|
org.cyclonedx:cyclonedx-core-java Maven | From 2.1.0 | 9.0.4 |
org.cyclonedx:cyclonedx-core-java Maven | From 2.1.0 | 9.0.4 |
How do I fix CVE-2024-38374?
Upgrade org.cyclonedx:cyclonedx-core-java to 9.0.4 or later.
Is CVE-2024-38374 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-38374 exists.
Sources
Also known as CVE-2024-38515, GHSA-683x-4444-jxh8.