CVE-2024-51136
📋 TL;DR
This XXE vulnerability in Dmoz2CSV allows attackers to read sensitive files from the server or execute arbitrary code by processing a malicious XML file. It affects openimaj v1.3.10 users who process XML files with the Dmoz2CSV tool. The high CVSS score reflects the potential for complete system compromise.
💻 Affected Systems
- openimaj Dmoz2CSV tool
📦 What is this software?
Openimaj by Openimaj
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution, allowing attackers to steal data, install malware, or pivot to other systems.
Likely Case
Information disclosure of sensitive server files (configuration files, credentials, source code) through XXE file reading.
If Mitigated
Limited impact if XML parsing is disabled or properly configured to reject external entities.
🎯 Exploit Status
Exploitation requires supplying a crafted XML file to the vulnerable tool. No authentication is needed if the tool is accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://github.com/openimaj/openimaj/issues/382
Restart Required: No
Instructions:
1. Monitor the GitHub issue for patches. 2. Consider disabling XML processing in Dmoz2CSV if possible. 3. Use workarounds to mitigate the vulnerability.
🔧 Temporary Workarounds
Disable XXE in XML parser
allConfigure the XML parser to disable external entity processing
Set XML parser properties: FEATURE_SECURE_PROCESSING = true, DISALLOW_DOCTYPE_DECL = true
Input validation
allValidate and sanitize XML input before processing
Implement XML schema validation or whitelist allowed XML structures
🧯 If You Can't Patch
- Disable the Dmoz2CSV tool entirely if not required
- Implement network segmentation to restrict access to the vulnerable service
🔍 How to Verify
Check if Vulnerable:
Check if you're using openimaj v1.3.10 with Dmoz2CSV tool enabled for XML processingCheck Version:
Check pom.xml or build.gradle for org.openimaj.tools:WebTools versionVerify Fix Applied:
Test with a safe XXE payload to confirm the parser rejects external entities📡 Detection & Monitoring
Log Indicators:
- Unusual XML processing errors
- File read attempts from unexpected locations
- Large XML file processing
Network Indicators:
- XML files with DOCTYPE declarations or external entity references being sent to the service
SIEM Query:
source="application.log" AND ("XXE" OR "DOCTYPE" OR "ENTITY") AND process="Dmoz2CSV"