CVE-2021-41411: XML External Entity Reference in drools
Summary
CVE-2021-41411: XML External Entity Reference in drools. Affects org.drools:drools-core versions < 7.60.0.Final. Fixed in 7.60.0.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drools-core package is a Maven ecosystem package that provides functionality for rule-based systems and complex event processing. It is widely used in various applications for business process management and decision management. However, versions up to 7.59.x of drools-core are affected by an XML External Entity (XXE) vulnerability in the KieModuleMarshaller.java file. This vulnerability arises due to incorrect usage of the Validator class, resulting in the injection of XXE attacks.
Vulnerability Detail
The XML External Entity (XXE) vulnerability in drools-core allows an attacker to exploit the application's XML parsing functionality to read arbitrary files from the server or conduct denial-of-service attacks. By injecting specially crafted XML entities, an attacker can force the application to disclose sensitive information or consume excessive resources, leading to potential data breaches or service disruptions. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
7.60.0.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable external entity resolution in the XML parser configuration. This can be achieved by configuring the XML parser to disallow the resolution of external entities. Here is an example of how to disable external entity resolution in Java using the DocumentBuilderFactory:
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
By disabling external entity resolution, you can mitigate the risk of XXE attacks, but it is still recommended to apply the permanent fix by upgrading to a non-vulnerable version of drools-core.
Conclusion
The XML External Entity (XXE) vulnerability in drools-core poses a significant risk to applications utilizing the affected versions. It is crucial to promptly apply the recommended fix by upgrading to version 7.60.0.Final or later. Additionally, consider implementing secure coding practices and validating user-supplied XML inputs to mitigate the risk of XXE vulnerabilities. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.drools:drools-core →
FAQ
An XML External Entity (XXE) vulnerability is a type of security flaw that allows an attacker to exploit an application's XML parsing functionality to read arbitrary files from the server or conduct denial-of-service attacks. By injecting specially crafted XML entities, an attacker can force the application to disclose sensitive information or consume excessive resources.
The XXE vulnerability in drools-core can potentially lead to data breaches or service disruptions. An attacker can exploit this vulnerability to read sensitive files from the server or cause the application to consume excessive resources, resulting in denial-of-service conditions.
This vulnerability has a CVSS score of 9.8, indicating its critical severity. It is crucial to address this vulnerability promptly to prevent potential security incidents.
To fix the XXE vulnerability in drools-core, it is recommended to upgrade to version 7.60.0.Final or later. This version includes the necessary fixes to prevent XXE attacks. Update the package in your project's pom.xml file and rebuild the application.
As a temporary workaround, you can disable external entity resolution in the XML parser configuration. This can help mitigate the risk of XXE attacks. However, it is still recommended to apply the permanent fix by upgrading to a non-vulnerable version of drools-core.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.drools:drools-core.
