SB20240624137 - XML External Entity injection in dependency-track

Description

This security bulletin contains information about 1 security vulnerability.

1) XML External Entity injection (CVE-ID: CVE-2024-38515)

The vulnerability allows a remote user to disclose sensitive information or cause a denial of service.

The vulnerability exists due to improper restriction of XML external entity references in the CycloneDX BOM XML parsing and schema version detection logic when processing uploaded CycloneDX BOMs in XML format. A remote user can upload a specially crafted XML BOM to disclose sensitive information or cause a denial of service.

Uploading BOMs requires authentication and the BOM_UPLOAD permission. Information disclosure primarily depends on XML parsing errors containing portions of targeted files.

Remediation

Install update from vendor's website.

References

• https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-7r6q-xj4c-37g4
• https://github.com/advisories/GHSA-7r6q-xj4c-37g4