Improper XML External Entity Reference Vulnerability in Apache SIS Metadata Package
Summary
GHSA-jqmr-2pg9-vfx7: Apache SIS has Improper Restriction of XML External Entity Reference vulnerability. Affects org.apache.sis.core:sis-metadata versions >= 0.4, < 1.6. Fixed in 1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache SIS (Spatial Information System) is an open-source library designed to facilitate the management and processing of geospatial data. It provides a set of services for reading and writing geospatial data formats, including GeoTIFF, ISO 19115 metadata, and GPS Exchange Format (GPX). The library is widely used in applications that require geospatial data manipulation and analysis. However, versions 0.4 through 1.5 of the Apache SIS core metadata package are vulnerable to an improper restriction of XML external entity references, which can lead to unauthorized access to local files on the server.
Vulnerability Detail
The vulnerability arises from the way Apache SIS processes XML files, allowing attackers to craft malicious XML documents that, when parsed, can disclose sensitive information from local files on the server. This can lead to significant security risks, including data leakage and unauthorized access to sensitive information. The vulnerability is classified under CWE-611, indicating improper handling of XML external entity references, which can be exploited in various services provided by Apache SIS.
How To Fix
Minimum fixed version
1.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can launch Java with the following system property to restrict external DTD access: java -Djavax.xml.accessExternalDTD="" -jar your-application.jar. This will help mitigate the risk until an upgrade can be performed.
Conclusion
The improper restriction of XML external entity references in Apache SIS poses a significant security risk, allowing attackers to access sensitive local files. Users are strongly advised to upgrade to version 1.6 or later to mitigate this vulnerability. Until an upgrade can be performed, implementing the suggested workaround can help reduce the risk.
See every vulnerability recorded for org.apache.sis.core:sis-metadata →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
Apache SIS versions 0.4 through 1.5 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to local files on the server, resulting in data leakage and potential security breaches.
Vulert monitors and alerts for open-source vulnerabilities in software using just the pom.xml file, providing real-time insights into potential security risks.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
