CVE-2020-10683: dom4j allows External Entities by default which might enable XXE attacks
Summary
CVE-2020-10683: dom4j allows External Entities by default which might enable XXE attacks. Affects org.dom4j:dom4j across 2 version ranges.
< 2.0.3
>= 2.1.0, < 2.1.3
Fixed in 2.0.3 or 2.1.3, depending on the release line you run. How to fix ↓
Also tracked for
- dom4j · Debian:11
The same CVE-2020-10683 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dom4j is a Java library for working with XML documents. It provides a simple and flexible API for parsing, manipulating, and creating XML documents. The library is widely used in various Java applications for XML processing. However, versions before 2.1.3 of dom4j allow external DTDs and External Entities by default, which can potentially enable XXE (XML External Entity) attacks. XXE attacks can lead to information disclosure, server-side request forgery, and even remote code execution.
Vulnerability Detail
The vulnerability in dom4j arises from its default behavior of allowing external DTDs and External Entities. This can be exploited by an attacker to read arbitrary files on the server, perform SSRF attacks, or execute arbitrary code. The vulnerability is classified as critical with a CVSS score of 9.8. It affects versions 1.x legacy artifacts of dom4j:dom4j and can be resolved by updating to the latest version of org.dom4j:dom4j (2.1.3 or higher).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.32.0.3 -
>= 2.1.0, < 2.1.32.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling external DTDs and External Entities in the dom4j configuration. This can be achieved by following the guidelines provided by OWASP in their documentation on secure XML processing. The workaround involves configuring the XML parser used by dom4j to disallow external entities and DTDs.
Conclusion
The vulnerability in dom4j allowing External Entities by default can be mitigated by updating to the latest version of org.dom4j:dom4j (2.1.3 or higher). It is important to promptly address this vulnerability to prevent potential information disclosure, SSRF attacks, or remote code execution. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.dom4j:dom4j →
FAQ
dom4j is a Java library for working with XML documents. It provides an API for parsing, manipulating, and creating XML documents in Java applications.
XXE (XML External Entity) is a type of attack that exploits the ability of XML parsers to include external entities. It can lead to information disclosure, SSRF attacks, and remote code execution.
This vulnerability allows an attacker to potentially read arbitrary files on the server, perform SSRF attacks, or execute arbitrary code, depending on the specific context and configuration of the application.
To fix this vulnerability, update the affected package to the latest version (2.1.3 or higher) of org.dom4j:dom4j. Additionally, review and update any custom code that uses dom4j to ensure it is not vulnerable to XXE attacks.
Yes, if updating to the latest version is not immediately feasible, you can implement a temporary workaround by disabling external DTDs and External Entities in the dom4j configuration. Follow the guidelines provided by OWASP for secure XML processing.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.dom4j:dom4j.
