CVE-2021-41042: XML External Entity Reference in Eclipse Lyo

Background

Eclipse Lyo is an open-source project that provides a set of Java libraries and tools for building and consuming Linked Data applications. It enables developers to work with Resource Description Framework (RDF) data and provides support for various RDF formats, including RDF/XML. The vulnerability identified as CVE-2021-41042 affects Eclipse Lyo versions 1.0.0 to 4.1.0. This vulnerability arises from the improper initialization of a TransformerFactory, which allows for the unrestricted loading of Document Type Definitions (DTDs) when processing RDF/XML. As a result, an attacker can exploit this vulnerability to retrieve external DTDs, potentially leading to information disclosure or other malicious activities.

Vulnerability Detail

The vulnerability in Eclipse Lyo versions 1.0.0 to 4.1.0 lies in the improper configuration of the TransformerFactory, which does not restrict the loading of DTDs when working with RDF/XML. This oversight enables an attacker to craft a malicious XML file that references an external DTD. When this XML file is processed by Eclipse Lyo, the application will attempt to retrieve the external DTD, potentially disclosing sensitive information or facilitating other attacks. The vulnerability has a CVSS score of 4.2, indicating a moderate severity level.

Workaround

As a temporary workaround, developers can manually configure the TransformerFactory to disable DTD loading. This can be achieved by setting the feature 'http://apache.org/xml/features/disallow-doctype-decl' to 'true' before performing any RDF/XML processing. Here is an example of how to implement this workaround in Java:

import javax.xml.parsers.DocumentBuilderFactory;

public class LyoDTDWorkaround {
    public static void main(String[] args) {
        try {
            DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
            factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
            // Perform RDF/XML processing
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Conclusion

In conclusion, the vulnerability CVE-2021-41042 in Eclipse Lyo versions 1.0.0 to 4.1.0 allows for the retrieval of external DTDs, potentially leading to information disclosure or other malicious activities. It is recommended to upgrade to a fixed version of Eclipse Lyo (5.0.0.Final or later) to mitigate this vulnerability. Alternatively, a temporary workaround is available by manually configuring the TransformerFactory to disable DTD loading. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.eclipse.lyo:lyo-parent →

FAQ