CVE-2018-20000: XXE vulnerability in bedework:bw-webdav
Summary
CVE-2018-20000: Improper Restriction of XML External Entity Reference in bedework:bw-webdav. Affects org.bedework:bw-webdav versions >= 4.0.1, < 4.0.3. Fixed in 4.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bedework:bw-webdav package is a Maven package that provides webdav functionality for the Bedework project. Bedework is an open-source calendar and resource management system. The bw-webdav package specifically handles webdav requests and servlets. It allows users to interact with calendar data and perform operations such as creating, updating, and deleting events. However, a vulnerability has been discovered in the package that allows for XML External Entity (XXE) attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2018-20000, is an improper restriction of XML External Entity Reference vulnerability in bedework:bw-webdav. The issue arises due to the lack of proper input validation and handling of XML data. An attacker can exploit this vulnerability by sending a specially crafted invite-reply document that includes an external entity reference to a local file. This can lead to various attacks, including reading sensitive information from the server or causing denial of service. The vulnerable code is located in the files webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.
How To Fix
Minimum fixed version
4.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed version as soon as possible to mitigate the risk of exploitation.
Conclusion
The bedework:bw-webdav package is vulnerable to an XML External Entity (XXE) attack, which can lead to information disclosure or denial of service. To mitigate this vulnerability, it is crucial to update the package to version 4.0.3 or later. Developers should update their project's dependencies and ensure that the fixed version of the package is included. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.bedework:bw-webdav →
FAQ
bedework:bw-webdav is a Maven package that provides webdav functionality for the Bedework project. It allows users to interact with calendar data and perform operations such as creating, updating, and deleting events.
An XML External Entity (XXE) attack is a type of attack that exploits vulnerabilities in XML parsers. By including external entity references in XML data, an attacker can read sensitive information from the server, perform remote code execution, or cause denial of service.
This vulnerability can be exploited by sending a specially crafted invite-reply document that includes an external entity reference to a local file. When the vulnerable code processes this document, it will attempt to resolve the external entity, leading to potential information disclosure or denial of service.
The impact of this vulnerability can vary depending on the specific attack scenario. In some cases, an attacker may be able to read sensitive information from the server, such as configuration files or user data. In other cases, the vulnerability may be used to cause denial of service by consuming excessive server resources.
Yes, a fix for this vulnerability is available in version 4.0.3 of the bedework:bw-webdav package. It is recommended to update to this version or later to mitigate the risk of exploitation.
