Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-42445— Possible local file exfiltration by XML External entity injection

Quick assessment

Affected
gradle gradle
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Gradle是美国Gradle公司的一套基于JVM的项目构建工具，它支持maven、Ivy仓库等。 Gradle 7.6.3之前 和 8.4之前版本存在代码问题漏洞，该漏洞源于在某些情况下，当 Gradle 解析 XML 文件时，不会禁用解析 XML 外部实体，与带外 XXE 攻击 (OOB-XXE) 相结合，仅解析 XML 就可能导致本地文本文件渗透到远程服务器。

CVSS 6.8 · Medium EPSS 0.78% · P56
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-42445

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Possible local file exfiltration by XML External entity injection
Source: CVE Program / CVE List V5
Vulnerability Description
Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5
Vulnerability Title
Gradle 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Gradle是美国Gradle公司的一套基于JVM的项目构建工具，它支持maven、Ivy仓库等。 Gradle 7.6.3之前 和 8.4之前版本存在代码问题漏洞，该漏洞源于在某些情况下，当 Gradle 解析 XML 文件时，不会禁用解析 XML 外部实体，与带外 XXE 攻击 (OOB-XXE) 相结合，仅解析 XML 就可能导致本地文本文件渗透到远程服务器。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
gradle gradle < 8.4 -

II. Public POCs for CVE-2023-42445

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-42445

请登录查看更多情报信息。

Vendor Advisories for CVE-2023-42445 (2)

Other References for CVE-2023-42445 (2)

IV. Related Vulnerabilities

Same product: gradle
Same vendor: gradle
Same weakness: CWE-611

V. Comments for CVE-2023-42445

No comments yet

Leave a comment