Malicious XML External Entity Injection in Hapi FHIR

CVE-2024-52007

What is CVE-2024-52007?

HAPI FHIR is a comprehensive implementation of the HL7 FHIR standard tailored for healthcare interoperability in Java. Recently, it has been found that its various components performing XSLT parsing are susceptible to XML external entity injections. This vulnerability enables an attacker to craft a malicious XML file containing a DTD reference, which could leverage sensitive information from the host system, such as data from '/etc/passwd'. This issue particularly affects implementations utilizing org.hl7.fhir.core in environments where external clients input XML data. It follows from prior vulnerabilities outlined in GHSA-6cr6-ph3p-f5rf, where earlier mitigation efforts were insufficient. Users of HAPI FHIR are strongly advised to upgrade to version 6.4.0 or higher, as there are currently no workarounds to address this issue.

References