Find, fix and prevent vulnerabilities in your code.

Overview

com.mchange:c3p0 is a mature, highly concurrent JDBC Connection pooling library, with support for caching and reuse of PreparedStatements.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the userOverridesAsString property of ConnectionPoolDataSource class. An attacker can achieve arbitrary code execution by supplying maliciously crafted serialized objects or javax.naming.Reference instances that trigger unsafe deserialization and remote code loading.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade com.mchange:c3p0 to version 0.12.0 or higher.

References

• GitHub Commit
• Vendor Advisory

Overview

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the factoryClassLocation function. An attacker can achieve arbitrary code execution by provoking the application to read a maliciously crafted javax.naming.Reference or serialized object, resulting in the download and execution of malicious code.

Remediation

Upgrade com.mchange:mchange-commons-java to version 0.4.0 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the toXmlDocument function of XmlStringPrettyFormatter. An attacker can read arbitrary local files, perform server-side request forgery, or cause denial of service by providing crafted XML input containing external entities.

Note: This formatter is used by isXmlEqualTo(CharSequence) and xmlPrettyFormat(String) and could be exploited if untrusted XML input is processed by the methods.

Workaround

Replace use of isXmlEqualTo(CharSequence) with XMLUnit.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

Upgrade org.assertj:assertj-core to version 3.27.7 or higher.

References

• GitHub Commit
• GitHub Release

Overview

org.openmrs.web:openmrs-web is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system (EMR).

Affected versions of this package are vulnerable to Denial of Service (DoS) due to failure to sanitize requests when satisfying GET requests for /images and /initfilter/scripts. This can allow an attacker to access any file on a system running OpenMRS that is accessible to the user id OpenMRS is running under.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

A fix was pushed into the master branch but not yet published.

References

• GitHub Commit
• Vulnerable Code

GPL-2.0 license