XXE Vulnerability in Terracotta Quartz Scheduler - libquartz-java and libquartz2-java
Summary
CVE-2019-13990: initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. Affects libquartz-java versions < 3533e4063644c0436ac5e873a75b647703aea6dd. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Terracotta Quartz Scheduler is a powerful open-source job scheduling library that allows developers to schedule jobs in Java applications. It provides features such as clustering, persistence, and job management. However, versions prior to 2.3.0 of libquartz-java and libquartz2-java are susceptible to XML External Entity (XXE) attacks, which can lead to unauthorized access to sensitive data and system resources.
Vulnerability Detail
The vulnerability, identified as CVE-2019-13990, arises from the initDocumentParser method in xml/XMLSchedulingDataProcessor.java. This flaw allows attackers to exploit XML parsing by injecting malicious XML content, which can lead to data exfiltration and system compromise. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk level. Attackers can craft job descriptions that, when processed, can access local files or perform other unauthorized actions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling XML parsing features or validating XML input to prevent malicious content from being processed. However, this is not a complete solution and upgrading is strongly recommended.
Conclusion
CVE-2019-13990 represents a significant risk for applications using Terracotta Quartz Scheduler versions prior to 2.3.0. It is crucial for developers to upgrade their libraries to the latest versions to safeguard against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libquartz-java →
FAQ
CVE-2019-13990 is a vulnerability in the Terracotta Quartz Scheduler that allows for XML External Entity (XXE) attacks through job descriptions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files, data exfiltration, and potential system compromise.
It is recommended to upgrade to the fixed versions of libquartz-java and libquartz2-java as soon as possible.
The CVSS score of CVE-2019-13990 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for libquartz-java.
