XXE Vulnerability in JetBrains Ktor Affecting XML Content Negotiation
CVE-2023-45612

8.6HIGH

Key Information:

Vendor

Jetbrains
Status
Ktor
Vendor
CVE Published:
9 October 2023

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2023-45612?

A security concern has been identified in JetBrains Ktor prior to version 2.3.5, where the default configuration of ContentNegotiation when handling XML formats is susceptible to XML External Entity (XXE) attacks. This vulnerability could allow an attacker to manipulate the XML input, potentially exposing sensitive data or leading to other malicious activities. Users of Ktor are urged to upgrade to the latest version to mitigate this risk and ensure the security of their applications.

Affected Version(s)

Ktor 0 < 2.3.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

ktor-xxe-poc
Created by bbugdigger

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.