CVE-2024-2374: XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to the inclusion of external resources.
By leveraging this vulnerability, an attacker can read confidential files from the file system and access limited HTTP resources reachable by the product. Additionally, the vulnerability can be exploited to perform denial of service attacks by exhausting server resources through recursive entity expansion or fetching large external resources.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2374?
CVE-2024-2374 has a significant severity due to the potential for arbitrary file read and denial of service attacks.
How do I fix CVE-2024-2374?
To fix CVE-2024-2374, update your WSO2 products to the latest versions that have addressed this vulnerability.
Which WSO2 products are affected by CVE-2024-2374?
CVE-2024-2374 impacts several WSO2 products including WSO2 API Manager, WSO2 Identity Server, and WSO2 Open Banking solutions.
What are the consequences of exploiting CVE-2024-2374?
Exploiting CVE-2024-2374 could lead to unauthorized file access and potentially denial of service for affected WSO2 applications.
Is there a workaround for CVE-2024-2374 while waiting for a patch?
Currently, there are no recommended workarounds for CVE-2024-2374 aside from limiting access to affected systems until a patch is applied.