CVE-2023-41034

DDFFileParser in eclipse leshan is vulnerable to XXE Attacks

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to `XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. This issue has been fixed in versions 1.5.0 and 2.0.0-M13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-08-22 CVE Reserved
2023-08-31 CVE Published
2024-09-27 CVE Updated
2024-10-02 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-611: Improper Restriction of XML External Entity Reference

CAPEC

References (5)

URL	Tag	Source
https://github.com/eclipse-leshan/leshan/security/advisories/GHSA-wc9j-gc65-3cm7	Mitigation
https://github.com/eclipse-leshan/leshan/wiki/Adding-new-objects#the-lwm2m-model	Product
https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing	Not Applicable

URL	Date	SRC

URL	Date	SRC
https://github.com/eclipse-leshan/leshan/commit/29577d2879ba8e7674c3b216a7f01193fc7ae013	2023-09-06
https://github.com/eclipse-leshan/leshan/commit/4d3e63ac271a817f81fba3e3229c519af7a3049c	2023-09-06

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				< 1.5.0 Search vendor "Eclipse" for product "Leshan" and version " < 1.5.0"		-		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone1		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone10		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone11		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone12		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone2		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone3		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone4		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone5		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone6		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone7		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone8		Affected
Eclipse Search vendor "Eclipse"		Leshan Search vendor "Eclipse" for product "Leshan"				2.0.0 Search vendor "Eclipse" for product "Leshan" and version "2.0.0"		milestone9		Affected