Skip to content

Commit d6d2761

Browse files
Gematik-EntwicklungGematik-Entwicklung
committed
Release 2.5.1
1 parent d276b02 commit d6d2761

File tree

21 files changed

+259
-52
lines changed

21 files changed

+259
-52
lines changed

‎ReleaseNotes.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@
22

33
# Release Notes Gematik Referenzvalidator
44

5+
## Release 2.5.1
6+
7+
### fixed
8+
- declining XML resources with DTD instructions due to vulnerability to XML eXternal Entity injection and thus Server Side Request Forgery (SSRF) attacks
9+
510
## Release 2.5.0
611

712
### added

‎cli/pom.xml

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<parent>
66
<artifactId>referencevalidator</artifactId>
77
<groupId>de.gematik.refv</groupId>
8-
<version>2.5.0</version>
8+
<version>2.5.1</version>
99
</parent>
1010
<properties>
1111
<integrationtest.folder>${basedir}/target/test-classes/pluginloader-integration-test</integrationtest.folder>
@@ -69,6 +69,7 @@
6969
<plugin>
7070
<groupId>org.codehaus.mojo</groupId>
7171
<artifactId>exec-maven-plugin</artifactId>
72+
<version>${version.exec-maven-plugin}</version>
7273
<executions>
7374
<execution>
7475
<id>verify-plugin-support</id>
@@ -106,11 +107,6 @@
106107
<groupId>info.picocli</groupId>
107108
<artifactId>picocli</artifactId>
108109
</dependency>
109-
<dependency>
110-
<groupId>org.mockito</groupId>
111-
<artifactId>mockito-junit-jupiter</artifactId>
112-
<scope>test</scope>
113-
</dependency>
114110
<dependency>
115111
<groupId>org.slf4j</groupId>
116112
<artifactId>slf4j-api</artifactId>

‎cli/src/main/java/de/gematik/refv/cli/ReferenceValidator.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,8 @@ public void run() {
132132
configureAllLoggersToDebug();
133133
}
134134

135+
redirectAllTcpTrafficToNonExistingProxyAsPreventiveSSRFMeasure();
136+
135137
ValidationModule validator = getValidationModule();
136138
if (validator == null) {
137139
log.debug("No suitable validation module found");
@@ -158,6 +160,11 @@ public void run() {
158160
}
159161
}
160162

163+
private static void redirectAllTcpTrafficToNonExistingProxyAsPreventiveSSRFMeasure() {
164+
System.setProperty("socksProxyHost", "localhost");
165+
System.setProperty("socksProxyPort", "1080");
166+
}
167+
161168
private ValidationOptions getValidationOptions() {
162169
ValidationOptions validationOptions = ValidationOptions.getDefaults();
163170
if(profile != null)

‎commons/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<parent>
66
<artifactId>referencevalidator</artifactId>
77
<groupId>de.gematik.refv</groupId>
8-
<version>2.5.0</version>
8+
<version>2.5.1</version>
99
</parent>
1010
<modelVersion>4.0.0</modelVersion>
1111

‎commons/src/main/java/de/gematik/refv/commons/validation/ReferencedProfileLocator.java

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,10 @@
2424

2525
import javax.xml.namespace.QName;
2626
import javax.xml.stream.XMLEventReader;
27+
import javax.xml.stream.XMLInputFactory;
2728
import javax.xml.stream.XMLStreamException;
2829
import javax.xml.stream.events.Attribute;
30+
import javax.xml.stream.events.DTD;
2931
import javax.xml.stream.events.StartElement;
3032
import javax.xml.stream.events.XMLEvent;
3133
import java.io.IOException;
@@ -36,10 +38,15 @@
3638
@Slf4j
3739
public class ReferencedProfileLocator {
3840

39-
private static final WstxInputFactory inputFactory = new WstxInputFactory();
41+
private static final WstxInputFactory inputFactory;
4042
private static final JsonFactory jsonfactory = new JsonFactory();
4143
private static final String PROFILE_STRING = "profile";
4244

45+
static {
46+
inputFactory = new WstxInputFactory();
47+
inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
48+
}
49+
4350
public List<String> getAllReferencedProfilesInResource(String resourceBody) {
4451
List<String> allProfilesInResource;
4552

@@ -65,8 +72,12 @@ private List<String> locateInXml(String resource) throws IllegalArgumentExceptio
6572
while (xmlEventReader.hasNext()) {
6673
XMLEvent event = xmlEventReader.nextEvent();
6774

75+
if (event instanceof DTD)
76+
throw new SecurityException("DTD is not allowed");
77+
6878
if (event.isStartElement()) {
6979
StartElement nextTag = event.asStartElement();
80+
7081
if (nextTag.getName().getLocalPart().equalsIgnoreCase("meta")) {
7182

7283
return locateProfileInMetaTagXml(xmlEventReader);

‎commons/src/test/java/de/gematik/refv/commons/security/XXETests.java

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
/*
2+
Copyright (c) 2022-2024 gematik GmbH
3+
4+
Licensed under the Apache License, Version 2.0 (the License);
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an 'AS IS' BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package de.gematik.refv.commons.security;
18+
19+
import de.gematik.refv.commons.helper.ValidationModuleFactory;
20+
import de.gematik.refv.commons.validation.ValidationModule;
21+
import lombok.SneakyThrows;
22+
import lombok.extern.slf4j.Slf4j;
23+
import org.junit.jupiter.api.Assertions;
24+
import org.junit.jupiter.api.BeforeAll;
25+
import org.junit.jupiter.params.ParameterizedTest;
26+
import org.junit.jupiter.params.provider.ValueSource;
27+
28+
import static com.ibm.icu.impl.Assert.fail;
29+
30+
/**
31+
* Cf. <a href="https://en.wikipedia.org/wiki/XML_external_entity_attack#cite_note-3">XML external entity attack</a>
32+
* Cf. <a href="https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html">XML External Entity Prevention Cheat Sheet</a>
33+
*
34+
*/
35+
@Slf4j
36+
public class XXETests {
37+
private static ValidationModule validationModule;
38+
39+
@BeforeAll
40+
@SneakyThrows
41+
static void beforeAll() {
42+
validationModule = ValidationModuleFactory.createInstance("simple");
43+
validationModule.initialize();
44+
}
45+
46+
@ParameterizedTest
47+
@ValueSource(strings = {
48+
"src/test/resources/security/xxe/doctype-system-url.xml",
49+
"src/test/resources/security/xxe/doctype-system-file.xml",
50+
"src/test/resources/security/xxe/doctype-internal-entity.xml",
51+
"src/test/resources/security/xxe/dtd-element.xml"
52+
})
53+
@SneakyThrows
54+
void DTDisNotAllowed(String path) {
55+
try {
56+
var result = validationModule.validateFile(path);
57+
log.debug(result.toString());
58+
fail("No exception is thrown");
59+
} catch (IllegalArgumentException e) {
60+
log.debug("Exception during validation", e);
61+
assertCorrectSecurityException(e);
62+
}
63+
}
64+
65+
private void assertCorrectSecurityException(Throwable e) {
66+
Assertions.assertNotNull(e.getCause(), "No security exception is thrown (cause empty)");
67+
Assertions.assertInstanceOf(SecurityException.class, e.getCause(), "No security exception is thrown (wrong cause type)");
68+
}
69+
}

‎commons/src/test/resources/security/xxe/doctype-internal-entity.xml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<!DOCTYPE foo [<!ENTITY hello "hello"> ]>
2+
<Patient xmlns="http://hl7.org/fhir">
3+
<id value="66033"/>
4+
<meta>
5+
<profile value="http://example.gematik.de/fhir/StructureDefinition/patient-with-birthdate|1.0.0" />
6+
<tag value="asd">&hello;</tag>
7+
</meta>
8+
<text>
9+
<status value="generated"/>
10+
<div xmlns="http://www.w3.org/1999/xhtml">hello</div>
11+
</text>
12+
<identifier>
13+
<system value="urn:oid:1.3.182.4.4"/>
14+
<value value="1998041799999"/>
15+
</identifier>
16+
<identifier>
17+
<system value="urn:ietf:rfc:3986"/>
18+
<value value="urn:uuid:647515ed-0d5e-4c99-b23d-073fbc593f76"/>
19+
</identifier>
20+
<name>
21+
<family value="Lux-Brennard"/>
22+
<given value="Marie"/>
23+
</name>
24+
<birthDate value="2023-01-01"/>
25+
</Patient>

‎commons/src/test/resources/security/xxe/doctype-system-file.xml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<!DOCTYPE foo [<!ENTITY getrequest SYSTEM "file:///c:/temp/test.txt"> ]>
2+
<Patient xmlns="http://hl7.org/fhir">
3+
<id value="66033"/>
4+
<meta>
5+
<profile value="http://example.gematik.de/fhir/StructureDefinition/patient-with-birthdate|1.0.0" />
6+
<tag value="asd">&getrequest;</tag>
7+
</meta>
8+
<text>
9+
<status value="generated"/>
10+
<div xmlns="http://www.w3.org/1999/xhtml">hello</div>
11+
</text>
12+
<identifier>
13+
<system value="urn:oid:1.3.182.4.4"/>
14+
<value value="1998041799999"/>
15+
</identifier>
16+
<identifier>
17+
<system value="urn:ietf:rfc:3986"/>
18+
<value value="urn:uuid:647515ed-0d5e-4c99-b23d-073fbc593f76"/>
19+
</identifier>
20+
<name>
21+
<family value="Lux-Brennard"/>
22+
<given value="Marie"/>
23+
</name>
24+
<birthDate value="2023-01-01"/>
25+
</Patient>

‎commons/src/test/resources/security/xxe/doctype-system-url.xml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<!DOCTYPE foo [<!ENTITY getrequest SYSTEM "http://non-existing-host:3000"> ]>
2+
<Patient xmlns="http://hl7.org/fhir">
3+
<id value="66033"/>
4+
<meta>
5+
<profile value="http://example.gematik.de/fhir/StructureDefinition/patient-with-birthdate|1.0.0" />
6+
<tag value="asd">&getrequest;</tag>
7+
</meta>
8+
<text>
9+
<status value="generated"/>
10+
<div xmlns="http://www.w3.org/1999/xhtml">hello</div>
11+
</text>
12+
<identifier>
13+
<system value="urn:oid:1.3.182.4.4"/>
14+
<value value="1998041799999"/>
15+
</identifier>
16+
<identifier>
17+
<system value="urn:ietf:rfc:3986"/>
18+
<value value="urn:uuid:647515ed-0d5e-4c99-b23d-073fbc593f76"/>
19+
</identifier>
20+
<name>
21+
<family value="Lux-Brennard"/>
22+
<given value="Marie"/>
23+
</name>
24+
<birthDate value="2023-01-01"/>
25+
</Patient>

‎commons/src/test/resources/security/xxe/dtd-element.xml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<!DOCTYPE foo [<!ELEMENT hello (#PCDATA)> <!ENTITY getrequest SYSTEM "http://localhost:3000">]>
2+
<Patient xmlns="http://hl7.org/fhir">
3+
<id value="66033"/>
4+
<meta>
5+
<profile value="http://example.gematik.de/fhir/StructureDefinition/patient-with-birthdate|1.0.0" />
6+
<tag value="asd">blabla</tag>
7+
</meta>
8+
<text>
9+
<status value="generated"/>
10+
<div xmlns="http://www.w3.org/1999/xhtml">hello</div>
11+
</text>
12+
<identifier>
13+
<system value="urn:oid:1.3.182.4.4"/>
14+
<value value="1998041799999"/>
15+
</identifier>
16+
<identifier>
17+
<system value="urn:ietf:rfc:3986"/>
18+
<value value="urn:uuid:647515ed-0d5e-4c99-b23d-073fbc593f76"/>
19+
</identifier>
20+
<name>
21+
<family value="Lux-Brennard"/>
22+
<given value="Marie"/>
23+
</name>
24+
<birthDate value="2023-01-01"/>
25+
</Patient>

‎core/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<parent>
66
<artifactId>referencevalidator</artifactId>
77
<groupId>de.gematik.refv</groupId>
8-
<version>2.5.0</version>
8+
<version>2.5.1</version>
99
</parent>
1010
<modelVersion>4.0.0</modelVersion>
1111

‎owasp-suppressions.xml

Lines changed: 37 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,26 +2,50 @@
22
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
33
<suppress>
44
<notes><![CDATA[
5-
file name: jackson-databind-2.15.2.jar
6-
not a security issue according to https://github.com/FasterXML/jackson-databind/issues/3972#issuecomment-1596193098
7-
]]></notes>
8-
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
9-
<cve>CVE-2023-35116</cve>
5+
file name: org.hl7.fhir.r4-6.0.1.jar
6+
the vulnerability is mitigated in HAPI wrapper classes and in the implementation of ReferencedProfileLocator starting with version 2.5.1
7+
]]></notes>
8+
<packageUrl regex="true">^pkg:maven/ca\.uhn\.hapi\.fhir/org\.hl7\.fhir\.r4@.*$</packageUrl>
9+
<vulnerabilityName>CVE-2024-45294</vulnerabilityName>
10+
</suppress>
11+
<suppress>
12+
<notes><![CDATA[
13+
file name: org.hl7.fhir.r5-6.0.1.jar
14+
the vulnerability is mitigated in HAPI wrapper classes and in the implementation of ReferencedProfileLocator starting with version 2.5.1
15+
]]></notes>
16+
<packageUrl regex="true">^pkg:maven/ca\.uhn\.hapi\.fhir/org\.hl7\.fhir\.r5@.*$</packageUrl>
17+
<vulnerabilityName>CVE-2024-45294</vulnerabilityName>
18+
</suppress>
19+
<suppress>
20+
<notes><![CDATA[
21+
file name: org.hl7.fhir.r4b-6.0.1.jar
22+
the vulnerability is mitigated in HAPI wrapper classes and in the implementation of ReferencedProfileLocator starting with version 2.5.1
23+
]]></notes>
24+
<packageUrl regex="true">^pkg:maven/ca\.uhn\.hapi\.fhir/org\.hl7\.fhir\.r4b@.*$</packageUrl>
25+
<vulnerabilityName>CVE-2024-45294</vulnerabilityName>
26+
</suppress>
27+
<suppress>
28+
<notes><![CDATA[
29+
file name: org.hl7.fhir.dstu3-6.0.1.jar
30+
the vulnerability is mitigated in HAPI wrapper classes and in the implementation of ReferencedProfileLocator starting with version 2.5.1
31+
]]></notes>
32+
<packageUrl regex="true">^pkg:maven/ca\.uhn\.hapi\.fhir/org\.hl7\.fhir\.dstu3@.*$</packageUrl>
33+
<vulnerabilityName>CVE-2024-45294</vulnerabilityName>
1034
</suppress>
1135
<suppress>
1236
<notes><![CDATA[
13-
file name: commons-compress-1.25.0.jar
14-
not a security issue as all used archives are embedded or come from trusted sources
37+
file name: org.hl7.fhir.dstu3-6.0.1.jar
38+
the vulnerability is mitigated in HAPI wrapper classes and in the implementation of ReferencedProfileLocator starting with version 2.5.1
1539
]]></notes>
16-
<packageUrl regex="true">^pkg:maven/org\.apache\.commons/commons\-compress@.*$</packageUrl>
17-
<cve>CVE-2024-25710</cve>
40+
<packageUrl regex="true">^pkg:maven/ca\.uhn\.hapi\.fhir/org\.hl7\.fhir\.utilities@.*$</packageUrl>
41+
<vulnerabilityName>CVE-2024-45294</vulnerabilityName>
1842
</suppress>
1943
<suppress>
2044
<notes><![CDATA[
21-
file name: commons-compress-1.25.0.jar
22-
not a security issue as all used archives are embedded or come from trusted sources
45+
file name: org.hl7.fhir.dstu3-6.0.1.jar
46+
the vulnerability is mitigated in HAPI wrapper classes and in the implementation of ReferencedProfileLocator starting with version 2.5.1
2347
]]></notes>
24-
<packageUrl regex="true">^pkg:maven/org\.apache\.commons/commons\-compress@.*$</packageUrl>
25-
<cve>CVE-2024-26308</cve>
48+
<packageUrl regex="true">^pkg:maven/ca\.uhn\.hapi\.fhir/org\.hl7\.fhir\.dstu2016may@.*$</packageUrl>
49+
<vulnerabilityName>CVE-2024-45294</vulnerabilityName>
2650
</suppress>
2751
</suppressions>

0 commit comments

Comments
 (0)