CyberRota Analysis
AI-GeneratedApplications utilizing the http4s-scala-xml library for XML parsing are vulnerable to XML External Entity (XXE) attacks due to insecure default configurations in the SAXParserFactory. This vulnerability can lead to unauthorized access to local files, server-side request forgery (SSRF), and denial of service through entity expansion. Organizations using affected versions should prioritize upgrading to versions 0.24.1 or 1.0.0-M39 to mitigate these critical risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Versions 0.24.1 and 1.0.0-M39 fix the issue.