Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-41098

CVE-2021-41098: Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2021-41098
GHSA ID
GHSA-2rr5-8q37-2w7h
EPSS Score
0.71883%
CWE
CWE-611
Published
9/27/2021
Updated
5/4/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
nokogirirubygems<= 1.12.41.12.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from SAX parsers resolving external entities by default on JRuby. The key fix in the commit adds NokogiriEntityResolver to XML SAX parsers (visible in XmlSaxParserContext.java's parse_with method). The absence of this resolver in vulnerable versions allowed XXE. The NokogiriHandler changes show error handling improvements related to entity resolution errors, indicating it was involved in the vulnerable flow. The high confidence for parse_with comes from direct security control (entity resolver) being missing, while medium confidence for NokogiriHandler reflects its secondary role in error handling during entity resolution.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### S*v*rity T** Noko*iri m*int*in*rs **v* *v*lu*t** t*is *s [***i** S*v*rity** *.* (*VSS*.*)](*ttps://www.*irst.or*/*vss/**l*ul*tor/*.*#*VSS:*.*/*V:N/**:L/PR:N/UI:N/S:U/*:*/I:N/*:N/*:*/RL:O/R*:*/M*V:N/M**:L) *or JRu*y us*rs. (T*is s**urity **visory

Reasoning

T** vuln*r**ility st*mm** *rom S*X p*rs*rs r*solvin* *xt*rn*l *ntiti*s *y ****ult on JRu*y. T** k*y *ix in t** *ommit ***s Noko*iri*ntityR*solv*r to XML S*X p*rs*rs (visi*l* in XmlS*xP*rs*r*ont*xt.j*v*'s p*rs*_wit* m*t*o*). T** **s*n** o* t*is r*solv