XML External Entity (XXE) vulnerability in libjgraphx-java
Summary
CVE-2017-18197: In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView. Affects libjgraphx-java across 2 version ranges.
< 2.1.0.7-2
< 8dea670d0aba25347900869c023bb1710832371d
Fixed in 2.1.0.7-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjgraphx-java is a Java library for creating and manipulating graph structures. It provides a set of classes and methods to build and visualize graphs. The library is widely used in various applications for graph-related tasks. However, a vulnerability has been discovered in the library that allows for XML External Entity (XXE) attacks.
Vulnerability Detail
The vulnerability (CVE-2017-18197) exists in the mxGraph component of libjgraphx-java. Specifically, the SAXParserFactory instance in mxGraphViewImageReader.java is missing flags to prevent XXE attacks. This vulnerability can be exploited by an attacker to read arbitrary files on the server or perform other malicious actions. The impact of this vulnerability can be severe, as it allows unauthorized access to sensitive information and potential remote code execution.
How To Fix
Minimum fixed version
2.1.0.7-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjgraphx-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the library is not immediately possible, a temporary workaround is to disable the processing of external entities in the XML parser used by mxGraphViewImageReader.java. This can be achieved by setting the appropriate feature flag in the XML parser configuration. Here is an example of how to disable external entity processing in Java:
SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
Please note that this workaround may have limitations and it is strongly recommended to update to the latest version of libjgraphx-java as soon as possible.
Conclusion
The XML External Entity (XXE) vulnerability in libjgraphx-java (CVE-2017-18197) can have severe consequences, including unauthorized access to sensitive information and potential remote code execution. It is crucial to update the library to the latest version (2.1.0.7-2 or later) to mitigate this vulnerability. If immediate update is not possible, consider applying the provided workaround. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libjgraphx-java →
FAQ
libjgraphx-java is a Java library used for creating and manipulating graph structures. It provides a set of classes and methods for graph-related tasks.
XML External Entity (XXE) vulnerability is a type of attack that exploits the functionality of XML parsers. It allows an attacker to read arbitrary files on the server or perform other malicious actions by including external entities in XML input.
The XXE vulnerability in libjgraphx-java can lead to unauthorized access to sensitive information and potential remote code execution. It poses a significant security risk to applications that use the library for graph-related tasks.
To fix the XXE vulnerability in libjgraphx-java, it is recommended to update the library to version 2.1.0.7-2 or later. This version includes the necessary security measures to prevent XXE attacks.
Yes, if updating the library is not immediately possible, you can disable the processing of external entities in the XML parser used by libjgraphx-java. However, this is a temporary workaround, and it is strongly advised to update to the latest version of the library as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for libjgraphx-java.
