CVE-2017-5661: Improper Restriction of XML External Entity Reference in Apache FOP
Summary
CVE-2017-5661: Improper Restriction of XML External Entity Reference in Apache FOP. Affects org.apache.xmlgraphics:fop versions < 2.2. Fixed in 2.2. How to fix ↓
Also tracked for
- fop · Debian:11
The same CVE-2017-5661 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache FOP is an open-source print formatter driven by XSL formatting objects. It is used to generate PDF, PS, PCL, AFP, XML (area tree representation), Print, AWT, and PNG output formats. This vulnerability affects versions prior to 2.2 of the Apache FOP package. The vulnerability allows arbitrary users to reveal files on the server's filesystem by sending maliciously formed SVG files. The severity of the vulnerability depends on the user context in which the exploitable application is running. If the user is root, it could lead to a full compromise of the server, including access to confidential or sensitive files. Additionally, the vulnerability can be used to launch denial-of-service attacks by triggering an amplification attack through XML External Entity (XXE) references within an XML document.
Vulnerability Detail
The vulnerability in Apache FOP before version 2.2 arises from improper restriction of XML External Entity (XXE) references. By exploiting this vulnerability, an attacker can reveal files on the server's filesystem. The impact of the vulnerability varies based on the user context. If the user is root, it could result in a complete compromise of the server, potentially exposing confidential or sensitive files. The vulnerability can also be exploited to launch denial-of-service attacks by triggering an amplification attack. The vulnerability is assigned the CVE identifier CVE-2017-5661 and has a CVSS score of 7.3.
How To Fix
Minimum fixed version
2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can implement input validation and sanitization mechanisms to prevent the processing of maliciously formed SVG files. This can involve validating and filtering user input to ensure that only trusted and safe files are processed by Apache FOP. Implementing strict file access controls and permissions can also help mitigate the impact of the vulnerability.
Conclusion
In conclusion, the vulnerability in Apache FOP before version 2.2 allows arbitrary users to reveal files on the server's filesystem and can lead to a full compromise of the server if the user is root. It is crucial to upgrade to Apache FOP version 2.2 or later to mitigate this vulnerability. Implementing input validation, sanitization mechanisms, and strict file access controls can provide additional protection. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.xmlgraphics:fop →
FAQ
Apache FOP is an open-source print formatter used to generate various output formats, such as PDF, PS, PCL, AFP, XML, and more.
The impact of this vulnerability depends on the user context. If the user is root, it could lead to a full compromise of the server, potentially exposing confidential or sensitive files. It can also be used to launch denial-of-service attacks.
To fix this vulnerability, it is recommended to upgrade to Apache FOP version 2.2 or later.
As a workaround, users can implement input validation and sanitization mechanisms to prevent the processing of malicious SVG files. Strict file access controls and permissions can also help mitigate the impact.
The CVSS score of this vulnerability is 7.3.
