CVE-2019-7722: Improper Restriction of XML External Entity Reference in PMD
Summary
CVE-2019-7722: Improper Restriction of XML External Entity Reference in PMD. Affects net.sourceforge.pmd:pmd-core versions < 6.0.0. Fixed in 6.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PMD is a static code analysis tool used to identify potential issues in software projects. It processes XML files called rulesets to perform the analysis. The vulnerability in PMD versions 5.8.1 and earlier allows attackers to exploit XML external entities in the ruleset files, leading to information disclosure, denial of service, or request forgery attacks. PMD 6.x is not affected due to a change implemented on September 15, 2017.
Vulnerability Detail
The vulnerability arises from PMD's improper handling of XML external entities in ruleset files. Attackers can manipulate these files, either by directly modifying them or through man-in-the-middle attacks when using remote rulesets. This manipulation can result in various security issues, including the disclosure of sensitive information, denial of service attacks, or the forging of requests.
How To Fix
Minimum fixed version
6.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating PMD is not immediately feasible, a temporary workaround is to avoid using rulesets from untrusted sources or remote rulesets. By limiting the exposure to potentially malicious rulesets, the risk of exploitation can be reduced.
Conclusion
The vulnerability in PMD versions 5.8.1 and earlier allows attackers to exploit XML external entities in ruleset files, leading to various security risks. To mitigate this vulnerability, it is recommended to update PMD to version 6.0.0 or later. Developers should also be cautious when using rulesets from untrusted sources or remote rulesets. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for net.sourceforge.pmd:pmd-core →
FAQ
PMD is a static code analysis tool used to identify potential issues in software projects. It analyzes code and provides feedback on coding standards, potential bugs, and other code quality aspects.
A ruleset in PMD is an XML file that specifies the rules and configurations to be used during the code analysis. It defines the criteria for identifying potential issues in the code.
An attacker can exploit this vulnerability by tampering with the ruleset files used by PMD. This can be done either by directly modifying the files or by performing man-in-the-middle attacks to manipulate remote rulesets.
The potential consequences of this vulnerability include information disclosure, denial of service attacks, and request forgery attacks. Attackers can gain access to sensitive information, disrupt the availability of the system, or manipulate requests to perform unauthorized actions.
No, PMD 6.x is not affected by this vulnerability. The issue was addressed in version 6.0.0, released on September 15, 2017.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.sourceforge.pmd:pmd-core.
