CVE-2020-10991: Improper Restriction of XML External Entity Reference in Mulesoft APIkit
Summary
CVE-2020-10991: Withdrawn Advisory: Improper Restriction of XML External Entity Reference in Mulesoft APIkit. Affects org.mule.modules:mule-apikit-module versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mulesoft APIkit is a Maven package that provides a set of tools and libraries for building RESTful APIs in Mule applications. It allows developers to easily define API specifications and generate the necessary code to implement the APIs. The package is widely used in various applications and frameworks for API development. However, a vulnerability has been discovered in versions up to 1.3.0 of the package, which allows for improper restriction of XML external entity references (XXE). This vulnerability can be exploited by an attacker to read arbitrary files on the server or launch denial-of-service attacks.
Vulnerability Detail
The vulnerability in Mulesoft APIkit is caused by a lack of proper validation in the RestXmlSchemaValidator.java file. This allows an attacker to include external entities in XML input, which can lead to various security issues. By exploiting this vulnerability, an attacker can read sensitive files on the server, perform remote code execution, or launch denial-of-service attacks. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable XML external entity processing in the application's XML parser configuration. This can be achieved by modifying the parser configuration to disallow the resolution of external entities. Here is an example of how to disable external entity processing in Java using the DocumentBuilderFactory class:
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
Note that this workaround may have implications on the functionality of the application, especially if it relies on XML processing that requires the use of external entities.
Conclusion
In conclusion, the Mulesoft APIkit package up to version 1.3.0 is vulnerable to an improper restriction of XML external entity references (XXE) issue. This vulnerability can be exploited by attackers to read sensitive files, execute remote code, or launch denial-of-service attacks. It is highly recommended to upgrade to version 1.3.1 or later to fix this vulnerability. If immediate upgrading is not possible, consider applying the provided workaround to disable XML external entity processing. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.mule.modules:mule-apikit-module →
FAQ
This vulnerability allows an attacker to read arbitrary files on the server, perform remote code execution, or launch denial-of-service attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it and alert you if any open-source vulnerabilities, including this one, are found.
Yes, a fix is available in version 1.3.1 or later of the Mulesoft APIkit package. It is recommended to upgrade to the latest version to mitigate this vulnerability.
Yes, you can temporarily disable XML external entity processing in your application's XML parser configuration. Please refer to the 'workaround' section for more details.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8.
