CVE-2019-13990: XML External Entity Injection in Terracotta Quartz Scheduler
Summary
CVE-2019-13990: XML external entity injection in Terracotta Quartz Scheduler. Affects org.quartz-scheduler:quartz versions < 2.3.2. Fixed in 2.3.2. How to fix ↓
Also tracked for
- libquartz-java · Debian:11
The same CVE-2019-13990 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Terracotta Quartz Scheduler is a popular open-source job scheduling library for Java applications. It provides a powerful and flexible way to schedule and manage jobs within an application. The library is widely used in various Maven projects. However, versions up to 2.3.0 are vulnerable to XML external entity (XXE) injection attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2019-13990, originates from the 'initDocumentParser' function in the 'xml/XMLSchedulingDataProcessor.java' file of Terracotta Quartz Scheduler. This function fails to properly handle external entities in job descriptions, making it susceptible to XXE attacks. An attacker can exploit this vulnerability by crafting a malicious job description that includes external entity references, leading to unauthorized access to sensitive information or denial of service.
How To Fix
Minimum fixed version
2.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can disable the processing of external entities in job descriptions. This can be achieved by modifying the 'xml/XMLSchedulingDataProcessor.java' file and removing any code that allows the resolution of external entities. Here is an example of the modified code:
// Remove the following line from the 'initDocumentParser' function
builder.setExpandEntityReferences(false);
Please note that this workaround is not recommended for long-term use, as it may impact the functionality of legitimate job descriptions.
Conclusion
The XML external entity (XXE) injection vulnerability in Terracotta Quartz Scheduler can have severe consequences, including unauthorized access to sensitive information or denial of service. It is crucial to upgrade to version 2.3.2 or later of the 'org.quartz-scheduler:quartz' package to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.quartz-scheduler:quartz →
FAQ
Terracotta Quartz Scheduler is an open-source job scheduling library for Java applications. It provides a flexible and powerful way to schedule and manage jobs within an application.
XML external entity (XXE) injection is a vulnerability that allows an attacker to exploit weakly configured XML parsers. By including external entity references in XML input, an attacker can access unauthorized files, perform server-side request forgery (SSRF) attacks, or cause denial of service.
The XXE vulnerability in Terracotta Quartz Scheduler allows an attacker to inject malicious XML content into job descriptions. This can lead to unauthorized access to sensitive information, SSRF attacks, or denial of service.
Yes, upgrading to version 2.3.2 or later of the 'org.quartz-scheduler:quartz' package fixes the XXE vulnerability in Terracotta Quartz Scheduler.
As a temporary workaround, developers can disable the processing of external entities in job descriptions. However, this workaround is not recommended for long-term use as it may impact legitimate job descriptions.
