CycloneDX Core Module Vulnerable to XML External Entity (XXE) Injection

CVE-2024-38374

Summary

The CycloneDX core module, utilized for creating and managing Software Bill of Materials (SBOM), exhibits a vulnerability due to improper XML deserialization practices. Specifically, the library leverages XPath expressions to ascertain the schema version of the SBOM without adequately securing the DocumentBuilderFactory. As a result, an attacker can exploit this flaw through malicious XML input, leading to potential XML External Entity (XXE) injection attacks. This vulnerability compromises the integrity of applications using the affected versions of the cyclonedx-core-java library, as it may allow attackers to read sensitive files or perform network requests. The issue has been addressed in cyclonedx-core-java version 9.0.4, where enhanced security measures have been implemented.

References