CVE-2024-51132 HAPI FHIR XML External Entity (XXE) vulnerability
Attackers can access sensitive information or execute arbitrary code via crafted XML requests in the HAPI FHIR library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-51132?
CVE-2024-51132 is a critical vulnerability in n/a, published on 5 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.
Weakness: CWE-611
Which versions are affected by CVE-2024-51132?
18 open source packages ship an affected version, including ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may.
| Package | Affected | Fixed in |
|---|---|---|
ca.uhn.hapi.fhir:org.hl7.fhir.convertors Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.convertors Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may Maven | All versions | 6.4.0 |
12 more packages
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4 Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4 Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4b Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r4b Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r5 Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.r5 Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.utilities Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.utilities Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.validation Maven | All versions | 6.4.0 |
ca.uhn.hapi.fhir:org.hl7.fhir.validation Maven | All versions | 6.4.0 |
How do I fix CVE-2024-51132?
Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.convertors to 6.4.0 or later.
Is CVE-2024-51132 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-51132 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-4cf2-cxp3-rjr7, ROOT-APP-MAVEN-CVE-2024-51132.