mxGraph vulnerable to XXE attacks

Description

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.

Recommendation

Update the mxgraph package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.7.6
• Patched version(s): 3.7.6

References

• GHSA-wvpv-8524-wg6x
• lists.debian.org
• CVE-2017-18197
• CWE-611
• CAPEC-310
• OWASP 2021-A5
• OWASP 2021-A6

Related Issues

• superagent vulnerable to zip bomb attacks - CVE-2017-16129
• jqueryFileTree vulnerable to Directory Traversal - CVE-2017-1000170
• ejs is vulnerable to remote code execution due to weak input validation - CVE-2017-1000228
• Sanitize-html Vulnerable To REDoS Attacks - CVE-2022-25887

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

mxgraph