Critical XML Entity Expansion Vulnerability in XMLBeans Package
Summary
CVE-2021-23926: The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Affects xmlbeans versions < 3.0.2-1. Fixed in 3.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XMLBeans is a powerful framework that allows developers to work with XML data in a more intuitive way by binding XML schemas to Java types. It provides a range of functionalities for parsing, validating, and manipulating XML documents. However, versions up to 2.6.0 of XMLBeans are vulnerable to XML Entity Expansion attacks, which can lead to denial of service and other security issues.
Vulnerability Detail
The vulnerability arises from the XML parsers used by XMLBeans, which do not set the necessary properties to safeguard against malicious XML input. This oversight can lead to XML Entity Expansion attacks, where an attacker can craft XML input that causes the parser to consume excessive resources, potentially leading to application crashes or denial of service. The vulnerability affects all versions of XMLBeans up to and including 2.6.0, making it critical for users to upgrade to a secure version.
How To Fix
Minimum fixed version
3.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade xmlbeansTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing input validation to limit the size and complexity of XML documents processed by the application. Additionally, configuring the XML parser to restrict entity expansion can help mitigate the risk temporarily.
Conclusion
The XML Entity Expansion vulnerability in XMLBeans poses significant risks to applications using affected versions. It is crucial for users to upgrade to version 3.0.2-1 or later to ensure their systems are secure. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for xmlbeans →
FAQ
XMLBeans is a Java framework that allows developers to work with XML data by binding XML schemas to Java types, enabling easier manipulation and validation of XML documents.
An XML Entity Expansion attack exploits the way XML parsers handle entity references, allowing attackers to create XML documents that cause excessive resource consumption, leading to denial of service.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without any installation.
The CVSS score for this vulnerability is 9.1, indicating a critical level of severity.
Yes, implementing input validation and configuring the XML parser to limit entity expansion can serve as temporary mitigations until an upgrade is possible.
Related vulnerabilities
Recent vulnerabilities recorded for xmlbeans.
