CVE-2024-34345 (JSON, published 2024-05-14T15:38Z)
Description: value: The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/CycloneDX/cyclonedx-javascript-library
Files changed:
HISTORY.md
package.json
src/validation/xmlValidator.node.ts
tests/integration/Validation.XmlValidator.test.js
Commit message: fix: revert to v6.6.1

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


Vulnerable code:
  "version": "6.7.0",
  compact: true,
  noent: true // prevent https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061

    it('is not vulnerable to advisories/GHSA-mjr4-7xg5-pfvh', async () => {
      /* report:
      see https://github.com/advisories/GHSA-mjr4-7xg5-pfvh
      see https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
      */
      const validator = new XmlValidator(version)
      /* POC payload:
      see https://research.jfrog.com/vulnerabilities/libxmljs2-attrs-type-confusion-rce-jfsa-2024-001034097/#poc
       */
      const input = `<?xml version="1.0" encoding="UTF-8"?>
        <!DOCTYPE note
        [
        <!ENTITY writer "` + 'A'.repeat(0x1234) + `">
        ]>
        <bom xmlns="http://cyclonedx.org/schema/bom/${version}">
          <components>
            <component type="library">
              <name>&writer;</name><!-- << XML external entity (XXE) injection -->
              <version>1.337</version>
              ${version === '1.0' ? '<modified>false</modified>' : ''}
            </component>
          </components>
        </bom>`
      const validationError = await validator.validate(input)
      assert.strictEqual(validationError, null)
    })

    it('is not vulnerable to advisories/GHSA-78h3-pg4x-j8cv', async () => {
      /* report:
      see https://github.com/advisories/GHSA-78h3-pg4x-j8cv
      see https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
      */
      const validator = new XmlValidator(version)
      /* POC payload:
      see https://research.jfrog.com/vulnerabilities/libxmljs2-namespaces-type-confusion-rce-jfsa-2024-001034098/#poc
      */
      const input = `<?xml version="1.0" encoding="UTF-8"?>
        <!DOCTYPE note
        [
        <!ENTITY writer PUBLIC "` + 'A'.repeat(8) + 'B'.repeat(8) + 'C'.repeat(8) + 'D'.repeat(8) + 'P'.repeat(8) + `" "JFrog Security">
        ]>
        <bom xmlns="http://cyclonedx.org/schema/bom/${version}">
          <components>
            <component type="library">
              <name>&writer;</name><!-- << XML external entity (XXE) injection -->
              <version>1.337</version>
              ${version === '1.0' ? '<modified>false</modified>' : ''}
            </component>
          </components>
        </bom>`
      const validationError = await validator.validate(input)
      assert.strictEqual(validationError, null)
    })

Fixed code:
## 6.7.1 -- 2024-05-07

Reverted v6.7.0, back to v6.6.1

!! THIS VERSION GOT YANKED !!

  "version": "6.6.1",
  compact: true