Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-52007

CVE-2024-52007:
XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

8.6

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-52007
GHSA ID
GHSA-gr3c-q7xf-47vh
EPSS Score
0.3995%
CWE
CWE-611
Published
11/8/2024
Updated
11/12/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3maven< 6.4.06.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4maven< 6.4.06.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4bmaven< 6.4.06.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r5maven< 6.4.06.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.utilitiesmaven< 6.4.06.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016maymaven< 6.4.06.4.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The analysis involved examining the patches provided for the XXE vulnerability fix in org.hl7.fhir.core. The patches showed changes in various XmlParser classes and utility classes related to XSLT processing, where insecure TransformerFactory instantiations were replaced with a secure method XMLUtil.newXXEProtectedTransformerFactory(). The functions that were modified are considered vulnerable or related to the vulnerability mitigation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Summ*ry XSLT p*rsin* p*r*orm** *y v*rious *ompon*nts *r* vuln*r**l* to XML *xt*rn*l *ntity inj**tions. * pro**ss** XML *il* wit* * m*li*ious *T* t** ( <!*O*TYP* *oo [<!*NTITY *x*mpl* SYST*M "/*t*/p*ssw*"> ]> *oul* pro*u** XML *ont*inin* **t* *rom

Reasoning

T** *n*lysis involv** *x*minin* t** p*t***s provi*** *or t** XX* vuln*r**ility *ix in `or*.*l*.**ir.*or*`. T** p*t***s s*ow** ***n**s in v*rious `XmlP*rs*r` *l*ss*s *n* utility *l*ss*s r*l*t** to XSLT pro**ssin*, w**r* ins**ur* `Tr*ns*orm*r***tory` i