Friday, November 8, 2024
HomeCyber Security NewsApache Ivy Injection Flaw Let Attackers Exfiltrate Sensitive Data

Apache Ivy Injection Flaw Let Attackers Exfiltrate Sensitive Data

Published on

Malware protection

A blind XPath injection vulnerability was discovered in Apache Software Foundation Apache Ivy, which allows threat actors to exfiltrate data and access sensitive information that is restricted to only the machine that runs Apache Ivy.

This vulnerability exists in the parsing of XML files in versions lesser than 2.5.2 while parsing its own configuration, Maven POMs (Project Object Models), which allows external document downloading and expansion of any entity references.

Threat actors can exploit this Blind XPath injection vulnerability to manipulate or execute the Ivy in different ways or access sensitive information inside the machine. This vulnerability is due to improper restriction of XML External Entity reference.

- Advertisement - SIEM as a Service

It is a dependency manager which resolves project dependencies and is a part of the Apache Ant project. It uses an XML file for defining project dependencies to list the necessary resources to build a project.

The CVE ID for this vulnerability has been given as CVE-2022-46751, and the CVSS score is yet to be confirmed.

Apache Ivy 2.5.2 version released

Prior to Apache Ivy version 2.5.2, Apache Ivy has DTD processing by default while parsing Maven POMs and other files.

However, as part of fixing the bug, Apache has released Apache Ivy version 2.5.2, which disables DTD (Document Type Definition) processing for all the files excluding Maven POMs, which allows only a DTD snippet to be included that is used for dealing with existing Maven POMs.

These are not valid XML files but are accepted by Maven POMs. Apache Ivy is a part of the Apache Ant project that specializes in automating software build processes which originated from the Apache Tomcat Project 2000.

Users are recommended to upgrade to the latest version of Apache Ivy 2.5.2 to prevent this vulnerability from getting exploited. As an alternative, Java system properties can be used to restrict the processing of external DTDs.

Keep informed about the latest Cyber Security News by following us on GoogleNewsLinkedinTwitter, and Facebook.

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability...

Cisco Desk Phone Series Vulnerability Lets Remote Attacker Access Sensitive Information

A significant vulnerability (CVE-2024-20445) has been discovered in Cisco Desk Phone 9800 Series, IP...

Cisco Flaw Let Attackers Run Command as Root User

A critical vulnerability has been discovered in Cisco Unified Industrial Wireless Software, which affects...

Researchers Detailed Credential Abuse Cycle

The United States Department of Justice has unsealed an indictment against Anonymous Sudan, a...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability...

Cisco Desk Phone Series Vulnerability Lets Remote Attacker Access Sensitive Information

A significant vulnerability (CVE-2024-20445) has been discovered in Cisco Desk Phone 9800 Series, IP...

Cisco Flaw Let Attackers Run Command as Root User

A critical vulnerability has been discovered in Cisco Unified Industrial Wireless Software, which affects...