CVE-2018-1000844: XML External Entity (XXE) vulnerability in Square Retrofit
Summary
CVE-2018-1000844: XML External Entity (XXE) vulnerability in Square Retrofit. Affects com.squareup.retrofit2:retrofit versions >= 2.0.0, < 2.5.0. Fixed in 2.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Square Retrofit is an open-source library for making HTTP requests in Android and Java applications. It provides a simple and flexible way to interact with RESTful APIs. The library is widely used in various projects and offers features such as request customization, response parsing, and error handling. However, versions prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 are vulnerable to an XML External Entity (XXE) vulnerability in JAXB.
Vulnerability Detail
The XML External Entity (XXE) vulnerability in Square Retrofit allows an attacker to exploit the JAXB component, potentially leading to remote file reading or Server-Side Request Forgery (SSRF) attacks. By sending specially crafted XML data, an attacker can trigger the parsing of external entities, which can result in unauthorized access to files on the file system or the ability to make requests to internal resources. This vulnerability has been assigned a CVSS score of 9.1 (Critical).
How To Fix
Minimum fixed version
2.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Retrofit to mitigate the risk.
Conclusion
The XML External Entity (XXE) vulnerability in Square Retrofit can pose a significant risk to applications using vulnerable versions of the library. It is crucial to upgrade to the fixed version (2.5.0 or later) to mitigate the risk of unauthorized file access or SSRF attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.squareup.retrofit2:retrofit →
FAQ
An XML External Entity (XXE) vulnerability is a type of attack that exploits the processing of XML data by an application. By including external entities in the XML, an attacker can read files from the file system or perform SSRF attacks.
JAXB (Java Architecture for XML Binding) is a Java API for mapping XML to Java objects and vice versa. It is commonly used for XML data binding in Java applications.
The XXE vulnerability in Square Retrofit can allow an attacker to read sensitive files from the file system or make unauthorized requests to internal resources. This can lead to information disclosure, data loss, or further exploitation of the affected system.
Yes, upgrading to version 2.5.0 or later of the com.squareup.retrofit2:retrofit package fixes the XXE vulnerability. It is recommended to update the dependency in your project to the latest fixed version.
You can find more information about this vulnerability in the GitHub Advisory Database. Additionally, you can use Vulert (https://vulert.com) to monitor and receive real-time alerts for open-source vulnerabilities in your software.
Related vulnerabilities
Recent vulnerabilities recorded for com.squareup.retrofit2:retrofit.
