CVE-2024-52807: XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`
Impact XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML.
A previous release provided an incomplete solution revealed by new testing.
Patches This issue has been patched as of version 1.7.4
Workarounds None
References Previous Advisory for Incomplete solution MITRE CWE OWASP XML External Entity Prevention Cheat Sheet
Other sources
The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML. A previous release provided an incomplete solution revealed by new testing. This issue has been patched as of version 1.7.4. No known workarounds are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52807?
The severity of CVE-2024-52807 has not been explicitly stated, but it is related to XML external entity injection vulnerabilities, which can pose a significant risk to sensitive data.
How do I fix CVE-2024-52807?
To fix CVE-2024-52807, you should upgrade to version 1.7.4 or later of the HL7 FHIR IG Publisher.
What components are affected by CVE-2024-52807?
CVE-2024-52807 affects the HL7 FHIR IG Publisher and its associated Maven packages including org.hl7.fhir.publisher.core and org.hl7.fhir.publisher.cli.
What types of attacks are possible with CVE-2024-52807?
CVE-2024-52807 enables XML external entity injection attacks, which can be used to extract sensitive data from the host system.
Is there any workaround for CVE-2024-52807?
There are no known workarounds for CVE-2024-52807; the only mitigation is to upgrade to the patched version.