External Entity Reference in TwelveMonkeys ImageIO

緊急 9.8CVE-2021-23792 · GHSA-pjch-4g28-fxx7 · SNYK-JAVA-COMTWELVEMONKEYSIMAGEIO-2316763 · 06/05/2022 公開 · 17/06/2026 更新

要点

CVE-2021-23792 は com.twelvemonkeys.imageio:imageio-metadata, twelvemonkeys (twelvemonkeys project) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.1%（全脆弱性の 65.0% より高い）。
対処：3.7.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
com.twelvemonkeys.imageio:imageio-metadata Maven	`< 3.7.1`	`3.7.1`
twelvemonkeys twelvemonkeys_project	`< 3.7.1`	`3.7.1`

概要

The package com.twelvemonkeys.imageio:imageio-metadata before version 3.7.1 is vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.

NVD の説明

The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.