CVE-2022-0198: XML External Entity Reference in edu.stanford.nlp:stanford-corenlp
Summary
CVE-2022-0198: XML External Entity Reference in edu.stanford.nlp:stanford-corenlp. Affects edu.stanford.nlp:stanford-corenlp versions < 4.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The edu.stanford.nlp:stanford-corenlp package is a Maven package that provides natural language processing capabilities. It is widely used for tasks such as text parsing, sentiment analysis, and named entity recognition. This package is vulnerable to an XML External Entity (XXE) attack.
Vulnerability Detail
The vulnerability in edu.stanford.nlp:stanford-corenlp arises from the TransformXML() function, which utilizes a SAXParser generated from a SAXParserFactory without the FEATURE_SECURE_PROCESSING set. This allows for XXE attacks, where an attacker can exploit the XML parsing functionality to read arbitrary files or execute remote requests. The impact of this vulnerability can range from unauthorized data access to denial of service attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to disable XML external entity processing in the application's XML parser. This can be achieved by setting the FEATURE_SECURE_PROCESSING property to true when creating the SAXParserFactory. Here's an example code snippet in Java:
SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
SAXParser parser = factory.newSAXParser();
Note that this workaround should only be used as a temporary measure until the package can be updated.
Conclusion
The edu.stanford.nlp:stanford-corenlp package is vulnerable to an XML External Entity (XXE) attack. It is crucial to update the package to a fixed version or apply the temporary workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for edu.stanford.nlp:stanford-corenlp →
FAQ
The vulnerability allows for XML External Entity (XXE) attacks, which can lead to unauthorized data access or denial of service attacks.
Update the edu.stanford.nlp:stanford-corenlp package to a version that includes the fix. Alternatively, you can disable XML external entity processing in the application's XML parser as a temporary workaround.
Yes, the CVSS score for this vulnerability is 6.1.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-mh83-jcw5-rjh8/GHSA-mh83-jcw5-rjh8.json
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for edu.stanford.nlp:stanford-corenlp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
