Description#
There is a XXE(XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances.
Affected http4k modules & versions#
http4k-format-xml- 5.40.0.0 and below
- 4.49.0.0 and below
Mitigation#
Users of affected versions should upgrade to the corresponding fixed version as below. http4k EE subscribers can access the fixed LTS versions through the dedicated http4k Maven instance. For more details about the http4k EE LTS versions, please contact http4k enterprise support
| Version | Fixed Version | Availability |
|---|---|---|
| <= 5.40.0.0 | 5.41.0.0 | Community & Enterprise Support |
| <= 4.49.0.0 | 4.50.0.0 | Enterprise Support Only |
Older, unsupported versions are also affected.
Resolution timeline#
| Date/time (UTC) | Notes |
|---|---|
| 12/12/2024 09:49 | Advisory opened by @JAckLosingHeart |
| 12/12/2024 10:04 | Advisory accepted and private fork created |
| 12/12/2024 10:15 | Issue recreated on private fork with failing test |
| 12/12/2024 10:56 | PR raised on private fork with fix and request for review |
| 12/12/2024 12:26 | PR reviewed and accepted |
| 12/12/2024 12:35 | PR merged |
| 12/12/2024 12:43 | CVE requested from GitHub |
| 12/12/2024 15:02 | CVE-2024-55875 assigned by GitHub |
| 12/12/2024 15:30 | Patch applied to http4k-LTS-v4, and http4k EE LTS v4.50.0.0 released to LTS Maven repo |
| 12/12/2024 16:11 | Fix released in http4k CE v5.41.0.0 and available in Maven Central |
| 12/12/2024 16:13 | Public disclosure |
References
- GitHub advisory: https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw
- NIST CVE registry: nvd.nist.gov/vuln/detail/CVE-2024-55875
