CVE-2024-34345: Insufficient Information (NVD-CWE-noinfo)
value: The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:38Z
Repository: https://github.com/CycloneDX/cyclonedx-javascript-library
Language: JSON
Files changed: HISTORY.md, package.json, src/validation/xmlValidator.node.ts, tests/integration/Validation.XmlValidator.test.js
Commit date: 2024-05-07 20:01:20 +0200
Commit message: fix: revert to v6.6.1

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Diff: diff --git a/HISTORY.md b/HISTORY.md
index 246a999..256d7b4 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -4,12 +4,18 @@ All notable changes to this project will be documented in this file.
 
 ## unreleased
 
 <!-- add unreleased items here -->
 
+## 6.7.1 -- 2024-05-07
+
+Reverted v6.7.0, back to v6.6.1
+
 ## 6.7.0 -- 2024-05-07
 
+!! THIS VERSION GOT YANKED !!
+
 * Changed
   * The provided XML validation capabilities no longer supports external entities (via [#1063]; concerns [#1061])  
     This is considered a security measure to prevent XML external entity (XXE) injection.
 
 [#1061]: https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
diff --git a/package.json b/package.json
index 066bd08..5ca81df 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "@cyclonedx/cyclonedx-library",
-  "version": "6.7.0",
+  "version": "6.6.1",
   "description": "Core functionality of CycloneDX for JavaScript (Node.js or WebBrowser).",
   "license": "Apache-2.0",
   "keywords": [
     "CycloneDX",
     "models",
diff --git a/src/validation/xmlValidator.node.ts b/src/validation/xmlValidator.node.ts
index 08601be..667657a 100644
--- a/src/validation/xmlValidator.node.ts
+++ b/src/validation/xmlValidator.node.ts
@@ -46,12 +46,11 @@ async function getParser (): Promise<typeof parseXml> {
   return _parser
 }
 
 const xmlParseOptions: Readonly<ParserOptions> = Object.freeze({
   nonet: true,
-  compact: true,
-  noent: true // prevent https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
+  compact: true
 })
 
 export class XmlValidator extends BaseValidator {
   #schema: Document | undefined
 
diff --git a/tests/integration/Validation.XmlValidator.test.js b/tests/integration/Validation.XmlValidator.test.js
index bbdf6bd..17a273a 100644
--- a/tests/integration/Validation.XmlValidator.test.js
+++ b/tests/integration/Validation.XmlValidator.test.js
@@ -97,61 +97,7 @@ describe('Validation.XmlValidator', () => {
           </components>
         </bom>`
       const validationError = await validator.validate(input)
       assert.strictEqual(validationError, null)
     })
-
-    it('is not vulnerable to advisories/GHSA-mjr4-7xg5-pfvh', async () => {
-      /* report:
-      see https://github.com/advisories/GHSA-mjr4-7xg5-pfvh
-      see https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
-      */
-      const validator = new XmlValidator(version)
-      /* POC payload:
-      see https://research.jfrog.com/vulnerabilities/libxmljs2-attrs-type-confusion-rce-jfsa-2024-001034097/#poc
-       */
-      const input = `<?xml version="1.0" encoding="UTF-8"?>
-        <!DOCTYPE note
-        [
-        <!ENTITY writer "` + 'A'.repeat(0x1234) + `">
-        ]>
-        <bom xmlns="http://cyclonedx.org/schema/bom/${version}">
-          <components>
-            <component type="library">
-              <name>&writer;</name><!-- << XML external entity (XXE) injection -->
-              <version>1.337</version>
-              ${version === '1.0' ? '<modified>false</modified>' : ''}
-            </component>
-          </components>
-        </bom>`
-      const validationError = await validator.validate(input)
-      assert.strictEqual(validationError, null)
-    })
-
-    it('is not vulnerable to advisories/GHSA-78h3-pg4x-j8cv', async () => {
-      /* report:
-      see https://github.com/advisories/GHSA-78h3-pg4x-j8cv
-      see https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
-      */
-      const validator = new XmlValidator(version)
-      /* POC payload:
-      see https://research.jfrog.com/vulnerabilities/libxmljs2-namespaces-type-confusion-rce-jfsa-2024-001034098/#poc
-      */
-      const input = `<?xml version="1.0" encoding="UTF-8"?>
-        <!DOCTYPE note
-        [
-        <!ENTITY writer PUBLIC "` + 'A'.repeat(8) + 'B'.repeat(8) + 'C'.repeat(8) + 'D'.repeat(8) + 'P'.repeat(8) + `" "JFrog Security">
-        ]>
-        <bom xmlns="http://cyclonedx.org/schema/bom/${version}">
-          <components>
-            <component type="library">
-              <name>&writer;</name><!-- << XML external entity (XXE) injection -->
-              <version>1.337</version>
-              ${version === '1.0' ? '<modified>false</modified>' : ''}
-            </component>
-          </components>
-        </bom>`
-      const validationError = await validator.validate(input)
-      assert.strictEqual(validationError, null)
-    })
   }))
 })

Vulnerable code:   "version": "6.7.0",
  compact: true,
  noent: true // prevent https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061

    it('is not vulnerable to advisories/GHSA-mjr4-7xg5-pfvh', async () => {
      /* report:
      see https://github.com/advisories/GHSA-mjr4-7xg5-pfvh
      see https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
      */
      const validator = new XmlValidator(version)
      /* POC payload:
      see https://research.jfrog.com/vulnerabilities/libxmljs2-attrs-type-confusion-rce-jfsa-2024-001034097/#poc
       */
      const input = `<?xml version="1.0" encoding="UTF-8"?>
        <!DOCTYPE note
        [
        <!ENTITY writer "` + 'A'.repeat(0x1234) + `">
        ]>
        <bom xmlns="http://cyclonedx.org/schema/bom/${version}">
          <components>
            <component type="library">
              <name>&writer;</name><!-- << XML external entity (XXE) injection -->
              <version>1.337</version>
              ${version === '1.0' ? '<modified>false</modified>' : ''}
            </component>
          </components>
        </bom>`
      const validationError = await validator.validate(input)
      assert.strictEqual(validationError, null)
    })

    it('is not vulnerable to advisories/GHSA-78h3-pg4x-j8cv', async () => {
      /* report:
      see https://github.com/advisories/GHSA-78h3-pg4x-j8cv
      see https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
      */
      const validator = new XmlValidator(version)
      /* POC payload:
      see https://research.jfrog.com/vulnerabilities/libxmljs2-namespaces-type-confusion-rce-jfsa-2024-001034098/#poc
      */
      const input = `<?xml version="1.0" encoding="UTF-8"?>
        <!DOCTYPE note
        [
        <!ENTITY writer PUBLIC "` + 'A'.repeat(8) + 'B'.repeat(8) + 'C'.repeat(8) + 'D'.repeat(8) + 'P'.repeat(8) + `" "JFrog Security">
        ]>
        <bom xmlns="http://cyclonedx.org/schema/bom/${version}">
          <components>
            <component type="library">
              <name>&writer;</name><!-- << XML external entity (XXE) injection -->
              <version>1.337</version>
              ${version === '1.0' ? '<modified>false</modified>' : ''}
            </component>
          </components>
        </bom>`
      const validationError = await validator.validate(input)
      assert.strictEqual(validationError, null)
    })
Fixed code: ## 6.7.1 -- 2024-05-07

Reverted v6.7.0, back to v6.6.1

!! THIS VERSION GOT YANKED !!

  "version": "6.6.1",
  compact: true