CVE-2021-29620: XXE vulnerability on Launch import with externally-defined DTD file in com.epam.reportportal:service-api
Summary
CVE-2021-29620: XXE vulnerability on Launch import with externally-defined DTD file. Affects com.epam.reportportal:service-api versions >= 3.1.0, < 5.4.0. Fixed in 5.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.epam.reportportal:service-api package is an open-source library used for JUnit XML launch import in the Report Portal service. It provides functionality for importing XML files and generating reports. However, starting from version 3.1.0, the XML parser in the library was not properly configured to prevent XML external entity (XXE) attacks. This vulnerability allows an attacker to import a specially-crafted XML file that includes an external Document Type Definition (DTD) file with external entities. This can lead to the extraction of secrets from the Report Portal service-api module or server-side request forgery.
Vulnerability Detail
The XXE vulnerability in com.epam.reportportal:service-api allows an attacker to exploit the XML parser's improper configuration and import a malicious XML file. By including an external DTD file with external entities, the attacker can extract sensitive information from the Report Portal service-api module or perform server-side request forgery. This can result in unauthorized access to confidential data or the execution of arbitrary requests on behalf of the server.
How To Fix
Minimum fixed version
5.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update to the fixed version, you can implement a workaround by disabling the JUnit XML launch import feature in the Report Portal service. This can be done by modifying the configuration or code that handles the import functionality. Here is an example of how to disable the feature in a Java application:
// Disable JUnit XML launch import
ReportPortalClient client = new ReportPortalClient();
client.setJUnitImportEnabled(false);
Conclusion
The XXE vulnerability in com.epam.reportportal:service-api can be exploited to extract sensitive information or perform server-side request forgery. It is recommended to update to version 5.4.0 or later to fix the vulnerability. If immediate update is not possible, disabling the JUnit XML launch import feature can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.epam.reportportal:service-api →
FAQ
The vulnerability allows an attacker to extract sensitive information from the Report Portal service-api module or perform server-side request forgery. This can lead to unauthorized access to confidential data or the execution of arbitrary requests on behalf of the server.
Versions 3.1.0 to 5.3.9 of com.epam.reportportal:service-api are affected by this vulnerability.
Yes, the vulnerability has been fixed in version 5.4.0 of com.epam.reportportal:service-api.
You can update the package by modifying the dependency in your project's pom.xml file or by using a package manager like Maven or Gradle to fetch the latest version.
If you are unable to immediately update to the fixed version, you can disable the JUnit XML launch import feature in the Report Portal service. This can be done by modifying the configuration or code that handles the import functionality.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.epam.reportportal:service-api.
