Critical XXE Vulnerability in dom4j Package: External DTDs and Entities Enabled by Default
Summary
CVE-2020-10683: dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. Affects dom4j across 3 version ranges.
< 2.1.3-1
< 7fbdc6d58623ec0b54b9b44a4738781b65191df1
< a8228522a99a02146106672a34c104adbda5c658
Fixed in 2.1.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dom4j is a popular open-source library used for working with XML in Java applications. It provides a flexible framework for parsing, creating, and manipulating XML documents. However, prior to version 2.1.3, dom4j had a significant security flaw that allowed external DTDs and entities to be processed by default, making applications vulnerable to XML External Entity (XXE) attacks. This vulnerability can lead to sensitive data exposure, denial of service, and other security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2020-10683, arises from the default configuration of dom4j versions before 2.0.3 and 2.1.x before 2.1.3, which permits the processing of external DTDs and entities. This behavior can be exploited by attackers to perform XXE attacks, potentially leading to unauthorized access to sensitive information or system resources. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk level.
How To Fix
Minimum fixed version
2.1.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade dom4jTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, you can mitigate the risk by configuring your XML parser to disable external entity processing. For example, if you are using a SAXParser, you can set the following properties:
System.setProperty("javax.xml.XMLParser", "com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl");
System.setProperty("javax.xml.parsers.SAXParserFactory", "com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl");
This will prevent the parser from processing external entities.
Conclusion
The CVE-2020-10683 vulnerability in the dom4j package poses a significant risk due to its default handling of external DTDs and entities, which can lead to XXE attacks. It is crucial for users of dom4j to upgrade to version 2.1.3 or later to mitigate this risk. Additionally, implementing proper configurations can help secure applications against potential exploits.
See every vulnerability recorded for dom4j →
FAQ
An XXE (XML External Entity) attack is a type of security vulnerability that allows an attacker to interfere with the processing of XML data. It can lead to data exposure, denial of service, and other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2020-10683 is 9.8, indicating a critical level of severity.
dom4j versions before 2.0.3 and 2.1.x before 2.1.3 are affected by this vulnerability.
Yes, OWASP provides documentation on how to enable safe, non-default behavior in applications that use dom4j.
References
Related vulnerabilities
Recent vulnerabilities recorded for dom4j.
