CVE-2022-0239: Improper Restriction of XML External Entity Reference in edu.stanford.nlp:stanford-corenlp
Summary
CVE-2022-0239: corenlp is vulnerable to Improper Restriction of XML External Entity Reference. Affects edu.stanford.nlp:stanford-corenlp versions < 4.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
edu.stanford.nlp:stanford-corenlp is an open-source library used for natural language processing tasks. It provides various functionalities for analyzing and processing text data. However, versions 0 to 4.3.2 of the library are vulnerable to an issue known as Improper Restriction of XML External Entity Reference.
Vulnerability Detail
The vulnerability in edu.stanford.nlp:stanford-corenlp arises from improper handling of XML external entity references. This can allow an attacker to exploit the application by including malicious XML entities in an XML document processed by the library. The consequences of this vulnerability can range from information disclosure to remote code execution, depending on the specific attack scenario. The vulnerability has been assigned a CVSS score of 9.8, indicating its critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can disable the processing of external entities in the XML parser configuration. This can be achieved by modifying the XML parser settings to disallow the resolution of external entities. Here is an example of how to disable external entity resolution in Java using the DocumentBuilderFactory:
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
By applying this workaround, the application can mitigate the risk associated with the vulnerability until a proper fix is implemented.
Conclusion
In conclusion, the edu.stanford.nlp:stanford-corenlp library versions 0 to 4.3.2 are vulnerable to Improper Restriction of XML External Entity Reference. It is crucial to update the library to a non-affected version and apply the recommended fix to protect the application from potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for edu.stanford.nlp:stanford-corenlp →
FAQ
The vulnerability allows an attacker to manipulate XML documents processed by edu.stanford.nlp:stanford-corenlp, potentially leading to information disclosure or remote code execution.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
Yes, updating the edu.stanford.nlp:stanford-corenlp library to a version beyond 4.3.2 resolves this vulnerability.
Yes, a temporary workaround is to disable the processing of external entities in the XML parser configuration.
Related vulnerabilities
Recent vulnerabilities recorded for edu.stanford.nlp:stanford-corenlp.
