XXE Vulnerability in Quartz Scheduler - libquartz-java and libquartz2-java
Summary
DEBIAN-CVE-2019-13990: initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. Affects libquartz-java versions < 1:1.8.6-8. Fixed in 1:1.8.6-8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libquartz-java and libquartz2-java are Java libraries that provide scheduling capabilities for applications. They allow developers to schedule jobs and manage task execution in a flexible manner. However, these libraries have been found to be vulnerable to XML External Entity (XXE) attacks, which can lead to unauthorized access to sensitive data and system resources.
Vulnerability Detail
The vulnerability, identified as CVE-2019-13990, arises from the initDocumentParser method in the XMLSchedulingDataProcessor.java file of the Terracotta Quartz Scheduler. This flaw allows attackers to exploit XXE attacks through malicious job descriptions, potentially leading to data exposure and system compromise. The vulnerability affects versions of the libraries prior to 2.3.0 for libquartz2-java and prior to 1:1.8.6-8 for libquartz-java.
How To Fix
Minimum fixed version
1:1.8.6-8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libquartz-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the packages is not immediately possible, consider disabling XML parsing features in your application or validating job descriptions to prevent malicious input.
Conclusion
The XXE vulnerability in libquartz-java and libquartz2-java poses significant risks to applications using these libraries. It is crucial to update to the patched versions to safeguard against potential attacks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for libquartz-java →
FAQ
CVE-2019-13990 is a vulnerability in the Quartz Scheduler libraries that allows for XML External Entity (XXE) attacks through job descriptions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
An XXE attack can lead to unauthorized access to sensitive data, system resource exposure, and potential remote code execution.
Versions prior to 1:1.8.6-8 for libquartz-java and prior to 2.3.0-3 for libquartz2-java are vulnerable.
Yes, you can disable XML parsing features or validate job descriptions to prevent the injection of malicious XML.
References
Related vulnerabilities
Recent vulnerabilities recorded for libquartz-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
