Critical XXE Injection Vulnerability in libtwelvemonkeys-java Package
Summary
CVE-2021-23792: The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. Affects libtwelvemonkeys-java versions < da4efe98bf09e1cce91b7633cb251958a200fc80. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The libtwelvemonkeys-java package is a widely used library for image processing in Java, providing support for various image formats and metadata handling. It is particularly known for its ability to read and write image metadata, making it a valuable tool for developers working with images. However, the package has been found to be vulnerable to an XML External Entity (XXE) Injection attack, which can compromise the security of applications that utilize it.
Vulnerability Detail
The vulnerability arises from an insecurely initialized XML parser used for reading XMP metadata in the libtwelvemonkeys-java package versions prior to 3.7.1. An attacker can exploit this vulnerability by supplying a specially crafted file containing malicious XMP segments. If the XMP metadata of the uploaded image is parsed, the XXE vulnerability is triggered, potentially leading to unauthorized access to sensitive data, server-side request forgery (SSRF), or other malicious activities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or user-uploaded images that contain XMP metadata until the package is updated. Additionally, consider implementing input validation and sanitization for any files being processed.
Conclusion
The libtwelvemonkeys-java package is vulnerable to a critical XXE Injection attack, which can have severe consequences for applications that utilize it. It is essential to update to the latest version to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for libtwelvemonkeys-java →
FAQ
XXE Injection is a type of attack that allows an attacker to interfere with the processing of XML data. It can lead to the disclosure of confidential data, server-side request forgery, and other security issues.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The impacts can include unauthorized access to sensitive data, server-side request forgery, and the ability for attackers to execute arbitrary code on the server.
Yes, versions 3.8.0-1 and later are safe and have addressed the XXE vulnerability.
If an immediate update is not possible, avoid processing untrusted images and implement input validation and sanitization as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for libtwelvemonkeys-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
