CVE-2014-2053: XML External Entity (XXE) vulnerability in getID3
Summary
CVE-2014-2053: getID3 is vulnerable to XML External Entity (XXE). Affects james-heinrich/getid3 versions < 1.9.9. Fixed in 1.9.9. How to fix ↓
Also tracked for
- php-getid3 · Debian:11
The same CVE-2014-2053 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
getID3 is a library used in ownCloud Server versions before 5.0.15 and 6.0.x before 6.0.2. It provides functionality for extracting metadata from various file formats. The library is commonly used to analyze audio and video files, allowing applications to retrieve information such as duration, bitrate, and codec details. However, a vulnerability in getID3 allows remote attackers to exploit XML External Entity (XXE) attacks, potentially leading to unauthorized file access, denial of service, or other impacts.
Vulnerability Detail
The vulnerability (CVE-2014-2053) in getID3 arises from its failure to properly handle XML External Entity (XXE) attacks. By submitting specially crafted XML input, an attacker can trigger the parsing of external entities, leading to various security issues. These include reading arbitrary files on the server, causing a denial of service, or potentially executing arbitrary code. The vulnerability has a severity rating of HIGH.
How To Fix
Minimum fixed version
1.9.9
This is the first release that contains the fix.
composer require james-heinrich/getid3:1.9.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating getID3 is not immediately feasible, a temporary workaround is to disable the processing of external entities in the XML parser used by getID3. This can be achieved by modifying the XML parsing configuration to disallow the resolution of external entities. However, this workaround may impact the functionality of certain features that rely on the processing of external entities.
Conclusion
The getID3 library used in ownCloud Server versions before 5.0.15 and 6.0.x before 6.0.2 is vulnerable to XML External Entity (XXE) attacks. This vulnerability can be exploited to read arbitrary files, cause a denial of service, or potentially execute arbitrary code. It is crucial to update getID3 to version 1.9.9 or later to mitigate this vulnerability. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for james-heinrich/getid3 →
FAQ
getID3 is a library used for extracting metadata from various file formats, commonly used in applications that handle audio and video files.
An XML External Entity (XXE) attack is a type of security vulnerability where an attacker can exploit the processing of external entities in XML parsers to read arbitrary files, cause a denial of service, or execute arbitrary code.
The getID3 vulnerability can be exploited by submitting specially crafted XML input that triggers the parsing of external entities. This allows an attacker to read arbitrary files, cause a denial of service, or potentially execute arbitrary code.
The getID3 vulnerability has a severity rating of HIGH.
To fix the vulnerability, update getID3 to version 1.9.9 or later. This version includes patches to mitigate the XML External Entity (XXE) vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for james-heinrich/getid3.
