CVE-2023-4218: XXE in eclipse.platform / Eclipse IDE
Impact xml files like ".project" are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
Vulnerablility was found by static code analysis (SonarLint).
Example .project file: <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE price [ <!ENTITY xxe SYSTEM "http://127.0.0.1:49416/evil">]> <projectDescription> <name>p</name> <comment>&xxe;</comment> </projectDescription>
Patches Similar patches including junit test that shows the vulnerability have already applied to PDE (see https://github.com/eclipse-pde/eclipse.pde/pull/667). A solution to platform should be the same: just reject parsing any XML that contains any DOCTYPE.
Workarounds No known workaround. User can only avoid to get/open any foreign files with eclipse. Firewall rules against loss of data (but not against XML bomb).
References https://cwe.mitre.org/data/definitions/611.html https://rules.sonarsource.com/java/RSPEC-2755 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 (Report for multiple projects affected)
Other sources
In Eclipse IDE versions 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
— IBM
In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-4218.
What is the title of this vulnerability?
The title of this vulnerability is 'XXE in eclipse.platform / Eclipse IDE'.
What is the severity level of CVE-2023-4218?
The severity level of CVE-2023-4218 is medium.
Which software versions are affected by CVE-2023-4218?
Eclipse IDE versions up to and excluding 4.29, Eclipse Org.eclipse.core.runtime versions up to and excluding 3.29.0, and Eclipse Pde versions up to and excluding 3.13.2400 are affected by CVE-2023-4218.
How can the vulnerability CVE-2023-4218 be exploited?
CVE-2023-4218 can be exploited by opening an evil project or updating an open project with a vulnerable file that contains XML content.