CVE-2024-45294 `org.hl7.fhir.core` XXE vulnerability in XSLT transforms

What is CVE-2024-45294?

CVE-2024-45294 is a high-severity vulnerability in hapifhir org.hl7.fhir.core, published on 6 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.

Weakness: CWE-611

Which versions are affected by CVE-2024-45294?

12 open source packages ship an affected version, including ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 and ca.uhn.hapi.fhir:org.hl7.fhir.r4.

How do I fix CVE-2024-45294?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.3.23 or later.

Is CVE-2024-45294 being exploited?

There is no known exploitation of CVE-2024-45294 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2024-45295, GHSA-6cr6-ph3p-f5rf, ROOT-APP-MAVEN-CVE-2024-45294.