CVE-2023-41034: XXE Attacks in DDFFileParser of org.eclipse.leshan:leshan-core
Summary
CVE-2023-41034: DDFFileParser is vulnerable to XXE Attacks. Affects org.eclipse.leshan:leshan-core across 2 version ranges.
< 1.5.0
>= 2.0.0-M1, < 2.0.0-M13
Fixed in 1.5.0 or 2.0.0-M13, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.eclipse.leshan:leshan-core package is an open-source library used for Lightweight M2M (LWM2M) device management. It provides functionality for parsing and validating DDF files, which are used to store LWM2M object descriptions. The DDFFileParser and DefaultDDFFileValidator classes in the package are vulnerable to XML External Entity (XXE) Attacks. This vulnerability allows an attacker to exploit the XML parsing functionality and potentially access sensitive information or execute arbitrary code.
Vulnerability Detail
The vulnerability arises from the lack of proper input validation and secure XML parsing in the DDFFileParser and DefaultDDFFileValidator classes. By providing a malicious DDF file containing external entity references, an attacker can trigger XXE Attacks. This can lead to various consequences, including information disclosure, denial of service, or remote code execution. Leshan users who parse untrusted DDF files are particularly affected by this vulnerability. However, if trusted DDF files are used and validated with trusted XML schemas, the risk is mitigated.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.5.01.5.0 -
>= 2.0.0-M1, < 2.0.0-M132.0.0-M13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround can be implemented by modifying the DDFFileParser and DefaultDDFFileValidator classes. The following code snippets demonstrate how to create a secure DocumentBuilderFactory for the DDFFileParser and a secure SchemaFactory for the DefaultDDFFileValidator:
For DDFFileParser:
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); // Disable DTDs
factory.setXIncludeAware(false); // Disable XML Inclusions
factory.setExpandEntityReferences(false); // Disable expand entity reference nodes
For DefaultDDFFileValidator:
SchemaFactory factory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
Conclusion
The XXE vulnerability in the DDFFileParser and DefaultDDFFileValidator classes of the org.eclipse.leshan:leshan-core package poses a moderate risk to LWM2M device management systems. Upgrading to the fixed versions is the recommended solution, but if immediate upgrade is not possible, implementing the provided workaround can help mitigate the risk. It is essential to stay informed about the latest security vulnerabilities and promptly address them to ensure the security of your software.
See every vulnerability recorded for org.eclipse.leshan:leshan-core →
FAQ
The vulnerability allows for XXE Attacks, which can result in information disclosure, denial of service, or remote code execution. It primarily affects users who parse untrusted DDF files in the Leshan package.
To mitigate the risk, it is recommended to upgrade to the fixed versions of the Leshan package (1.5.0 or later for Leshan 1.x, and 2.0.0-M13 or later for Leshan 2.x). Additionally, ensure that only trusted DDF files are parsed and validated with trusted XML schemas.
If upgrading to the fixed versions is not immediately feasible, a temporary workaround can be implemented by modifying the DDFFileParser and DefaultDDFFileValidator classes as described in the 'workaround' section.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to address the vulnerability promptly to prevent potential exploitation.
You can refer to the OWASP website for more information on XML External Entity (XXE) Attacks: https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
