CVE-2022-0272: XML External Entity Reference in detekt
Summary
CVE-2022-0272: XML External Entity Reference in detekt. Affects io.gitlab.arturbosch.detekt:detekt-core versions < 1.20.0. Fixed in 1.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The detekt package, specifically the detekt-core module, is an open-source static code analysis tool for Kotlin. It is commonly used to identify code smells, anti-patterns, and potential bugs in Kotlin projects. The detekt-core module is a key component of the detekt package and provides the core functionality for analyzing Kotlin code. Unfortunately, prior to version 1.20.0, detekt was vulnerable to an XML External Entity (XXE) Reference vulnerability.
Vulnerability Detail
The vulnerability in detekt arises from improper restriction of XML External Entity references. This vulnerability allows an attacker to exploit XML parsing functionality in detekt and potentially gain unauthorized access to sensitive information or execute arbitrary code. The vulnerability has a CVSS score of 7.3, indicating a high severity level. It was identified and reported by GitHub's advisory database.
How To Fix
Minimum fixed version
1.20.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The XML External Entity Reference vulnerability in detekt has the potential to expose sensitive information or allow arbitrary code execution. It is crucial to update the detekt package to version 1.20.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.gitlab.arturbosch.detekt:detekt-core →
FAQ
Detekt is an open-source static code analysis tool for Kotlin projects. It helps identify code smells, anti-patterns, and potential bugs.
The detekt-core module is a key component of the detekt package. It provides the core functionality for analyzing Kotlin code.
An XML External Entity (XXE) Reference vulnerability occurs when an XML parser processes external entities defined in the XML document, leading to potential information disclosure or code execution.
The vulnerability has a CVSS score of 7.3, indicating a high severity level.
To fix the vulnerability, update the detekt package to version 1.20.0 or later by modifying the dependency declaration in your project's Maven configuration file (pom.xml).
