Vulnerability in mxGraph: XXE Attacks
Summary
CVE-2017-18197: mxGraph vulnerable to XXE attacks. Affects mxgraph versions < 3.7.6. Fixed in 3.7.6. How to fix ↓
Also tracked for
- libjgraphx-java · Debian:11
The same CVE-2017-18197 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mxGraph is an npm package that provides a JavaScript diagramming library for building interactive diagrams and graph visualizations. It is widely used for creating graphical representations in web applications. However, a vulnerability has been discovered in mxGraph that makes it susceptible to XML External Entity (XXE) attacks.
Vulnerability Detail
The vulnerability exists in the mxGraphViewImageReader.java file of mxGraph before version 3.7.6. The convert() function in this file uses a SAXParserFactory instance without proper flags to prevent XXE attacks. This oversight allows an attacker to exploit the vulnerability by injecting malicious XML content, potentially leading to various security risks. An example of the payload that triggers the vulnerability is /ServerView.
How To Fix
Minimum fixed version
3.7.6
This is the first release that contains the fix.
npm install mxgraph@3.7.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of mxGraph to ensure the security of your application.
Conclusion
The vulnerability in mxGraph exposes applications to XML External Entity (XXE) attacks, which can have severe security implications. To ensure the security of your application, it is crucial to update to the fixed version of mxGraph (3.7.6 or later). For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mxgraph →
FAQ
mxGraph is an npm package that provides a JavaScript diagramming library for creating interactive diagrams and graph visualizations in web applications.
An XML External Entity (XXE) attack is a type of security vulnerability that allows an attacker to exploit weakly configured XML parsers. By injecting malicious XML content, an attacker can read sensitive data, perform server-side request forgery (SSRF), and potentially execute arbitrary code.
The vulnerability in mxGraph allows an attacker to perform XXE attacks, which can lead to unauthorized access to sensitive data, server-side request forgery (SSRF), and potential remote code execution. It is crucial to update to the fixed version of mxGraph to mitigate these risks.
No, there is no known workaround for this vulnerability. It is recommended to update to the fixed version of mxGraph as soon as possible.
To update the mxGraph package, you can use the following command: npm update mxgraph. This will install the latest version of mxGraph, which includes the necessary fixes for the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for mxgraph.
