Critical XXE Vulnerability in JDOM Packages: libjdom1-java and libjdom2-java
Summary
UBUNTU-CVE-2021-33813: An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. Affects libjdom1-java versions 1.1.2+dfsg-2build1 – 1.1.3-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JDOM is a popular Java library that provides a convenient way to work with XML data. It allows developers to parse, manipulate, and create XML documents easily. The library is widely used in various applications due to its simplicity and efficiency. However, certain versions of JDOM are vulnerable to an XML External Entity (XXE) attack, which can lead to denial of service and other security issues.
Vulnerability Detail
The vulnerability stems from an XXE issue in SAXBuilder in JDOM versions up to 2.0.6. This flaw allows attackers to craft malicious XML input that can exploit the XML parser's handling of external entities. As a result, an attacker can cause a denial of service by sending a specially crafted HTTP request, potentially leading to application crashes or resource exhaustion. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the processing of external entities in your XML parser configuration. This can be done by setting the appropriate properties in your SAXBuilder instance:
SAXBuilder saxBuilder = new SAXBuilder();
saxBuilder.setFeature("http://xml.org/sax/features/external-general-entities", false);
saxBuilder.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
Conclusion
The XXE vulnerability in JDOM packages libjdom1-java and libjdom2-java poses a significant risk to applications using these libraries. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until updates can be applied.
See every vulnerability recorded for libjdom1-java →
FAQ
An XXE (XML External Entity) vulnerability allows attackers to interfere with the processing of XML data, potentially leading to data exposure or denial of service.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground.
Consequences can include denial of service, data leakage, and potential exploitation of the underlying system.
Using older versions of JDOM that are vulnerable to XXE attacks is not safe. It is recommended to upgrade to the latest patched versions.
If you cannot update immediately, implement workarounds such as disabling external entity processing in your XML parser.
Related vulnerabilities
Recent vulnerabilities recorded for libjdom1-java.
