CVE-2023-42445

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gradle/gradle/releases/tag/v7.6.3	Release Notes
https://github.com/gradle/gradle/releases/tag/v8.4.0	Release Notes
https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8	Vendor Advisory
https://security.netapp.com/advisory/ntap-20231110-0006/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gradle:gradle::::::::
	cpe:2.3:a:gradle:gradle::::::::

History

16 Feb 2024, 15:27

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-06 14:15

Updated : 2024-03-06 15:20

NVD link : CVE-2023-42445

Mitre link : CVE-2023-42445

CVE.ORG link : CVE-2023-42445

JSON object : View

Products Affected

gradle

gradle

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2023-42445", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "published": "2023-10-06T14:15:12.103", "references": [{"url": "https://github.com/gradle/gradle/releases/tag/v7.6.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gradle/gradle/releases/tag/v8.4.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gradle/gradle/security/advisories/GHSA-mrff-q8qj-xvg8", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://security.netapp.com/advisory/ntap-20231110-0006/", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities.\n"}, {"lang": "es", "value": "Gradle es una herramienta de compilaci\u00f3n centrada en la automatizaci\u00f3n de la build y soporte para el desarrollo en varios idiomas. En algunos casos, cuando Gradle analiza archivos XML, la resoluci\u00f3n de entidades externas XML no est\u00e1 deshabilitada. Combinado con un ataque XXE fuera de banda (OOB-XXE), el simple hecho de analizar XML puede provocar la filtraci\u00f3n de archivos de texto locales a un servidor remoto. Gradle analiza archivos XML para varios prop\u00f3sitos. La mayor\u00eda de las veces, Gradle analiza los archivos XML que gener\u00f3 o que ya estaban presentes localmente. Gradle solo puede recuperar los descriptores XML de Ivy y los archivos POM de Maven de repositorios remotos y analizarlos. En Gradle 7.6.3 y 8.4, la resoluci\u00f3n de entidades externas XML se ha deshabilitado para todos los casos de uso para proteger contra esta vulnerabilidad. Gradle ahora se negar\u00e1 a analizar archivos XML que tengan entidades externas XML."}], "lastModified": "2024-03-06T15:20:29.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77803A01-94E7-4C76-BAF3-ED44AE596010", "versionEndExcluding": "7.6.3"}, {"criteria": "cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E104EF19-8B72-4A31-B2AC-8312F7C6452F", "versionEndExcluding": "8.4.0", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}