XML External Entity Injection Vulnerability in http4k for Kotlin Applications
CVE-2024-55875
Key Information:
Badges
What is CVE-2024-55875?
CVE-2024-55875 describes a serious security flaw in the http4k functional toolkit for Kotlin HTTP applications, specifically prior to version 5.41.0.0. This vulnerability arises from inadequate handling of XML data, allowing XML External Entity (XXE) injections. Exploiting this vulnerability could enable malicious actors to access sensitive data stored on the server, potentially leading to Server-side Request Forgery (SSRF) and, under certain circumstances, remote code execution. Users are strongly encouraged to upgrade to the patched version 5.41.0.0 to mitigate this critical risk.
Affected Version(s)
http4k < 6.50.0.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.