CVE-2021-43090: XML External Entity (XXE) Vulnerability in soa-model
Summary
CVE-2021-43090: Improper Restriction of XML External Entity Reference in soa-model. Affects com.predic8:soa-model-parent versions < 1.6.4. Fixed in 1.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The soa-model is a toolkit and Java API for WSDL, WADL, and XML Schema. It provides functionality for working with these XML-based formats, allowing developers to parse, manipulate, and generate XML documents. The soa-model is commonly used in applications that involve web services and XML data processing. However, versions of soa-model prior to 1.6.4 are vulnerable to an XML External Entity (XXE) attack.
Vulnerability Detail
The XML External Entity (XXE) vulnerability in soa-model versions prior to 1.6.4 is due to improper restriction of XML external entity references in the WSDLParser function. This vulnerability allows an attacker to include external entities in XML documents processed by the soa-model, leading to various security risks. An attacker can exploit this vulnerability to read arbitrary files on the server, perform server-side request forgery (SSRF) attacks, or launch denial-of-service attacks. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.6.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of the soa-model library to mitigate the risk.
Conclusion
The XML External Entity (XXE) vulnerability in soa-model versions prior to 1.6.4 poses a significant security risk. It is crucial for developers to upgrade to the fixed version of the soa-model library to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.predic8:soa-model-parent →
FAQ
This vulnerability allows an attacker to read arbitrary files on the server, perform server-side request forgery (SSRF) attacks, or launch denial-of-service attacks.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Yes, upgrading to version 1.6.4 or later of the soa-model library fixes this vulnerability.
The fixed version of the soa-model library can be obtained from the Maven repository or the official project website.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8.
