CVE-2019-9843: Improper Restriction of XML External Entity Reference in DiffPlug Spotless
Summary
CVE-2019-9843: Improper Restriction of XML External Entity Reference in DiffPlug Spotless. Affects com.diffplug.spotless:spotless-plugin-gradle versions < 3.20.0. Fixed in 3.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DiffPlug Spotless is a library and set of plugins for Maven and Gradle that provides a convenient way to format and apply code style rules to various file types. It is commonly used in software development projects to enforce consistent code formatting. However, versions before 1.20.0 (Maven plugin) and 3.20.0 (Gradle plugin) suffer from an improper restriction of XML external entity reference vulnerability.
Vulnerability Detail
The XML parser used in DiffPlug Spotless resolves external entities over both HTTP and HTTPS, regardless of the resolveExternalEntities setting. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack and potentially disclose the contents of files to the attacker. An attacker could exploit this vulnerability by tricking a victim into performing a spotlessApply operation on a malicious XML file.
How To Fix
Minimum fixed version
3.20.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to update to the fixed versions mentioned above.
Conclusion
The vulnerability in DiffPlug Spotless allows for improper restriction of XML external entity reference, potentially leading to disclosure of file contents to a MITM attacker. It is crucial to update to the fixed versions (1.20.0 or later for Maven plugin, 3.20.0 or later for Gradle plugin) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.diffplug.spotless:spotless-plugin-gradle →
FAQ
DiffPlug Spotless is a library and set of plugins for Maven and Gradle that provides code formatting and style enforcement capabilities.
An XML external entity reference is a feature that allows XML documents to include data from external sources. In this vulnerability, the XML parser resolves external entities over both HTTP and HTTPS, which can be exploited by an attacker.
A man-in-the-middle (MITM) attack is a type of cyber attack where an attacker intercepts and potentially alters communications between two parties without their knowledge. In this vulnerability, an attacker could perform a MITM attack to disclose file contents.
To update DiffPlug Spotless, you can use the package manager for your respective build tool (Maven or Gradle) and specify the updated version in your project configuration file (pom.xml or build.gradle).
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert provides real-time monitoring and alerts for open-source vulnerabilities without requiring access to the code or installation.
