Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-23901

CVE-2021-23901:
XML external entity (XXE) injection in Apache Nutch

9.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-23901
GHSA ID
GHSA-fxhp-wrw9-3r97
EPSS Score
0.79729%
CWE
CWE-611
Published
3/18/2022
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.nutch:nutchmaven< 1.181.18

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure XML parsing in DmozParser. While exact patch diffs aren't shown, the CVE/JIRA details indicate:

  1. XXE occurs in DmozParser's XML processing
  2. Fix involved xercesImpl upgrade (2.12.1) which typically requires SAFER parser configuration
  3. Common XXE patterns involve missing security features in SAXParser/DocumentBuilderFactory
  4. The parse() method would be the entry point for XML processing
  5. createReader() would be where parser configuration occurs High confidence on parse() as the exploitation entry point, medium on createReader() as configuration point based on standard XXE mitigation patterns

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n XML *xt*rn*l *ntity (XX*) inj**tion vuln*r**ility w*s *is*ov*r** in t** Nut** *mozP*rs*r *n* is known to *****t Nut** v*rsions < *.**. XML *xt*rn*l *ntity inj**tion (*lso known *s XX*) is * w** s**urity vuln*r**ility t**t *llows *n *tt**k*r to int

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* XML p*rsin* in *mozP*rs*r. W*il* *x**t p*t** *i**s *r*n't s*own, t** *V*/JIR* **t*ils in*i**t*: *. XX* o**urs in *mozP*rs*r's XML pro**ssin* *. *ix involv** x*r**sImpl up*r*** (*.**.*) w*i** typi**lly r*quir*s S*