Vulnerabilities

 3 via 26 paths

Dependencies

 110

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
  • 1
  • 1
Status
  • 3
  • 0
  • 0

high severity
new

XML External Entity (XXE) Injection

  • Vulnerable module: org.glassfish.jaxb:jaxb-core
  • Introduced through: org.ligoj.bootstrap:bootstrap-business@5.0.3

Detailed paths

  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.hibernate.orm:hibernate-core@7.4.12.Final › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-extension-providers@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.hibernate.orm:hibernate-scan-jandex@7.4.12.Final › org.hibernate.orm:hibernate-core@7.4.12.Final › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-extension-providers@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-extension-providers@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-extension-providers@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-common-openapi@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-swagger-ui@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-common-openapi@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-swagger-ui@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-security@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-common-openapi@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.apache.cxf:cxf-rt-rs-service-description-openapi-v3@4.2.4 › org.apache.cxf:cxf-rt-rs-service-description-swagger-ui@4.2.4 › org.apache.cxf:cxf-rt-frontend-jaxrs@4.2.4 › org.apache.cxf:cxf-rt-transports-http@4.2.4 › org.apache.cxf:cxf-core@4.2.4 › org.glassfish.jaxb:jaxb-runtime@4.0.9 › org.glassfish.jaxb:jaxb-core@4.0.9

Overview

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection in the createParserFactory and createDocumentBuilderFactory methods of the XmlFactory class, which set only XMLConstants.FEATURE_SECURE_PROCESSING on the factory and leave disallow-doctype-decl, external-general-entities, external-parameter-entities, and load-external-dtd at their defaults. An attacker can read local files out of band by submitting XML containing an external entity declaration to an application that unmarshals untrusted documents. Exploitation depends on the JAXP implementation in use, because secure processing alone does not block external entity resolution on every implementation.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

A fix was pushed into the master branch but not yet published.

References

XML External Entity (XXE) Injection vulnerability report

medium severity
new

Expression Language Injection

  • Vulnerable module: org.hibernate.validator:hibernate-validator
  • Introduced through: org.ligoj.bootstrap:bootstrap-business@5.0.3

Detailed paths

  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.hibernate.validator:hibernate-validator@9.1.4.Final

Overview

org.hibernate.validator:hibernate-validator is a Hibernate Validator Engine Relocation Artifact.

Affected versions of this package are vulnerable to Expression Language Injection in the ParameterTermResolver class, whose resolveExpression method converts a message parameter value to a string with toString and Arrays.toString without escaping, so the result is carried into the subsequent Expression Language pass of AbstractMessageInterpolator and re-evaluated. An attacker can exhaust server resources by submitting a collection whose duplicate elements render as an Expression Language fragment, which UniqueElementsValidator binds into the duplicates message parameter and which is then evaluated during construction of the violation message. This requires the application to apply @UniqueElements, or another constraint binding attacker-influenced data through addMessageParameter, to input the attacker controls, and the standard constraint message feature level of BEAN_PROPERTIES bounds evaluation to bean property access rather than arbitrary method calls.

Workaround

This vulnerability can be avoided by setting hibernate.validator.constraint_expression_language_feature_level to none, which disables Expression Language interpolation of constraint messages entirely at the cost of any messages that rely on it.

Remediation

Upgrade org.hibernate.validator:hibernate-validator to version 9.2.0.Beta1 or higher.

References

Expression Language Injection vulnerability report

low severity
new

Improper Validation of Specified Type of Input

  • Vulnerable module: jakarta.validation:jakarta.validation-api
  • Introduced through: org.ligoj.bootstrap:bootstrap-business@5.0.3

Detailed paths

  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › org.hibernate.validator:hibernate-validator@9.1.4.Final › jakarta.validation:jakarta.validation-api@3.1.1
  • Introduced through: ligoj/plugin-scm-git@ligoj/plugin-scm-git › org.ligoj.bootstrap:bootstrap-business@5.0.3 › org.ligoj.bootstrap:bootstrap-core@5.0.3 › io.github.vpelikh:swagger-jaxrs2-jakarta@3.0.0 › io.github.vpelikh:swagger-integration-jakarta@3.0.0 › io.github.vpelikh:swagger-core-jakarta@3.0.0 › jakarta.validation:jakarta.validation-api@3.1.1

Overview

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the run method of the ProviderSpecificBootstrapImpl class in Validation.java, which passes a caller influenced action to the single argument form of AccessController.doPrivileged, dropping the calling thread's restricted ProtectionDomain from the access control stack. Code running in a restricted domain can execute an arbitrary class's no-arg constructor under the library's broader permissions by passing any Class object to Validation.byProvider through a raw or unchecked cast, since the generic bound is erased and NewProviderInstance.run reaches clazz.newInstance before the cast to ValidationProvider is attempted. Exploitation requires a JVM running with a SecurityManager, a code source for the library granted more permissions than the caller, the ability to run code in process, and a reachable class in a privileged domain whose public no-arg constructor performs a security checked side effect, and the gadget's own ProtectionDomain stays on the stack so a self defined class yields nothing.

Note: Only deployments on JDK releases before 24 are affected. The run helper elevates privilege only when System.getSecurityManager() returns non-null, and JEP 486 permanently disabled the Security Manager in JDK 24.

Remediation

Upgrade jakarta.validation:jakarta.validation-api to version 4.0.0-M1 or higher.

References

Improper Validation of Specified Type of Input vulnerability report