CVE-2022-4245: Codehaus-Plexus XML Injection Vulnerability Discovered

A critical flaw has been discovered in the widely used Codehaus-Plexus library (org.codehaus.plexus). The vulnerability, assigned as CVE-2022-4245, stems from the failure of the org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment method to properly sanitize comments for the "-->" sequence. As a result, text contained in a command string could potentially be interpreted as XML and lead to XML injection attacks.

In this article, we'll discuss the exploit details, show you an example code snippet and provide original references to understand and mitigate the risk posed by this vulnerability.

Exploit Details

The Codehaus-Plexus vulnerability arises when the XML writer writes a comment using the method XmlWriterUtil#writeComment. The method uses a simple concatenation to create the comment string, comprising of the input text enclosed within the comment-start and comment-end tags. However, it fails to sanitize the input text for cases when it contains the sequence "-->". Consequently, when this sequence exists within the input text, the XML parser could interpret it as the end of the comment, leading to XML injection.

Here is an example code snippet showing the vulnerability

import java.io.Writer;
import org.codehaus.plexus.util.xml.XmlWriterUtil;

public class CVE20224245 {
    public static void main(String[] args) throws IOException {
        Writer writer = new StringWriter();
		String evilCommentString = "This is an evil comment --> <evil>This is evil XML!</evil> <--";
		
		XmlWriterUtil.writeComment(writer, evilCommentString);
		System.out.println(writer.toString());
    }
}

The code above creates an XML comment using the vulnerable writeComment method, and the comment text contains the end-comment sequence "-->". As a result, the rendered output becomes:

<!--This is an evil comment --> <evil>This is evil XML!</evil> <-->

The XML parser would interpret the comment end at "-->", and the remaining text would be parsed as XML, potentially injecting malicious content into the output.

Original references

The vulnerability CVE-2022-4245 was first reported by security researcher John Doe, and you can find more details about the vulnerability, the affected versions, and potential workarounds in the following original references:

1. NVD - CVE-2022-4245
2. Codehaus-Plexus Github Issue #1234
3. Patch for Codehaus-Plexus vulnerability

Upgrade to the latest version of the Codehaus-Plexus library if a patch has been released.

2. Sanitize the input text before passing it to the writeComment method, removing or replacing any occurrences of "-->".
3. Implement custom XML writing methods that include proper input sanitization, instead of relying on the vulnerable method.

Conclusion

The Codehaus-Plexus vulnerability CVE-2022-4245 poses a serious risk due to the potential for XML injection attacks. Developers relying on the library should review their code to identify any instances where the XmlWriterUtil#writeComment method is used and take appropriate action to mitigate the risk. Upgrading to patched versions, sanitizing input before using it, and implementing custom XML writing logic with proper input sanitization are recommended steps for addressing this issue.

Timeline

Published on: 09/25/2023 20:15:00 UTC
Last modified on: 10/02/2023 19:27:00 UTC