CVE-2018-15531: JavaMelody XXE Vulnerability in net.bull.javamelody:javamelody-core
Summary
CVE-2018-15531: JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java. Affects net.bull.javamelody:javamelody-core versions < 1.74.0. Fixed in 1.74.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
net.bull.javamelody:javamelody-core is a Maven package that provides monitoring and performance analysis for Java applications. It is commonly used to collect and display statistics about the behavior of an application. However, versions before 1.74.0 are vulnerable to an XML External Entity (XXE) attack through the parseSoapMethodName function in the bull/javamelody/PayloadNameRequestWrapper.java file.
Vulnerability Detail
The XXE vulnerability in JavaMelody allows an attacker to read arbitrary files on the server or conduct denial-of-service attacks by exploiting the XML parsing functionality. By sending specially crafted XML data, an attacker can trigger the parsing of external entities, leading to the disclosure of sensitive information or resource exhaustion. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
1.74.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the SOAP monitoring feature in JavaMelody. This can be done by modifying the configuration to exclude SOAP-related requests from being monitored. Here is an example of how to modify the configuration in the web.xml file:
<filter> ``` <filter-name>monitoring</filter-name> <filter-class>net.bull.javamelody.MonitoringFilter</filter-class> <init-param> <param-name>monitoring-parameters</param-name> <param-value>excluded-parameters=soap</param-value> </init-param> ``` </filter><filter-mapping>
<filter-name>monitoring</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Conclusion
The XXE vulnerability in net.bull.javamelody:javamelody-core versions before 1.74.0 can be exploited to read arbitrary files or conduct denial-of-service attacks. It is crucial to upgrade to the latest secure version or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for net.bull.javamelody:javamelody-core →
FAQ
The XXE vulnerability in JavaMelody can lead to the disclosure of sensitive information or denial-of-service attacks. An attacker could read arbitrary files on the server or exhaust server resources, potentially impacting the availability and confidentiality of the application.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your application.
Yes, upgrading to version 1.74.0 or later of net.bull.javamelody:javamelody-core fixes this vulnerability. It is recommended to update the package in your Maven configuration to ensure the latest secure version is used.
Yes, if upgrading to the latest version is not immediately feasible, you can disable the SOAP monitoring feature in JavaMelody. This can be done by modifying the configuration in the web.xml file to exclude SOAP-related requests from being monitored.
For more information about this vulnerability, you can refer to the GitHub advisory database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-6fvx-r7hx-3vh6/GHSA-6fvx-r7hx-3vh6.json).
Related vulnerabilities
Recent vulnerabilities recorded for net.bull.javamelody:javamelody-core.
