CVE-2016-15026: dd-plist XML External Entity Vulnerability
Summary
CVE-2016-15026: dd-plist XML External Entitly vulnerability. Affects com.googlecode.plist:dd-plist versions < 1.18. Fixed in 1.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dd-plist package is a Maven ecosystem package named 'com.googlecode.plist:dd-plist'. It is used for working with plist files in Java applications. Plist files are XML-based files used to store structured data. The dd-plist package provides functionality to read and write plist files in Java. However, version 1.17 of the package is vulnerable to an XML External Entity (XXE) attack.
Vulnerability Detail
The vulnerability in dd-plist version 1.17 is due to improper handling of XML external entity references. An attacker can exploit this vulnerability by providing a specially crafted plist file that includes external entity references. When the vulnerable code parses the plist file, it resolves these external entities, leading to potential information disclosure or denial of service attacks. This vulnerability can only be exploited locally, requiring the attacker to have access to the affected system. The Common Vulnerabilities and Exposures (CVE) identifier assigned to this vulnerability is CVE-2016-15026. The vulnerability has a CVSSv3 score of 7.8, indicating a high severity.
How To Fix
Minimum fixed version
1.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to upgrade to the fixed version 1.18.
Conclusion
The dd-plist package version 1.17 is vulnerable to an XML External Entity (XXE) attack. To mitigate this vulnerability, it is recommended to upgrade to version 1.18. For further support on vulnerability remediation, you can contact DevNack.com. Vulert (https://vulert.com) is a tool that can help monitor and alert for open-source vulnerabilities in software, using just the pom.xml file.
See every vulnerability recorded for com.googlecode.plist:dd-plist →
FAQ
dd-plist is a Maven package used for working with plist files in Java applications. Plist files are XML-based files used to store structured data.
An XML External Entity (XXE) attack is a type of attack where an attacker can exploit a vulnerability in XML parsing to disclose internal files or perform denial of service attacks.
The vulnerability in dd-plist version 1.17 can be exploited by an attacker to potentially disclose sensitive information or cause denial of service by providing a specially crafted plist file.
No, this vulnerability can only be exploited locally. The attacker needs access to the affected system to exploit the vulnerability.
The vulnerability has a CVSSv3 score of 7.8, indicating a high severity.
