CVE-2024-52807 XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`

What is CVE-2024-52807?

CVE-2024-52807 is a high-severity vulnerability in HL7 fhir-ig-publisher, published on 24 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag `( ]>` could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML. A previous release provided an incomplete solution revealed by new testing. This issue has been patched as of version 1.7.4. No known workarounds are available.

Weakness: CWE-611

Which versions are affected by CVE-2024-52807?

4 open source packages ship an affected version, including org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli and org.hl7.fhir.publisher:org.hl7.fhir.publisher.core.

How do I fix CVE-2024-52807?

Upgrade org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli to 1.7.4 or later.

Is CVE-2024-52807 being exploited?

There is no known exploitation of CVE-2024-52807 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8c3x-hq82-gjcm.