CVE-2024-52807
Published: 24 January 2025
Summary
CVE-2024-52807 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely patching of the HL7 FHIR IG publisher to version 1.7.4, which remediates the XXE vulnerability in XSLT transform components.
Requires validation of XML inputs to detect and block malicious DTD tags that enable external entity injection during processing by the publisher.
Enforces secure configuration of XML parsers and XSLT processors to disable external entity resolution, addressing the root cause of the XXE vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XXE enables remote file read via crafted XML input to a network-accessible publisher component (T1190) and directly facilitates collection of arbitrary local files/data from the host (T1005).
NVD Description
The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML…
more
file with a malicious DTD tag `( ]>` could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML. A previous release provided an incomplete solution revealed by new testing. This issue has been patched as of version 1.7.4. No known workarounds are available.
Deeper analysisAI
CVE-2024-52807 is an XML external entity (XXE) injection vulnerability, classified under CWE-611, affecting the HL7 FHIR Implementation Guide (IG) publisher prior to version 1.7.4. This tool processes inputs to generate standard FHIR IGs and performs XSLT transforms on XML files. A malicious DTD tag, such as one containing `]>` , in a processed XML file can lead to the inclusion of sensitive data from the host system in the output XML. The vulnerability was incompletely addressed in a prior release, as revealed by additional testing.
The issue enables exploitation in scenarios where the org.hl7.fhir.publisher component runs on a host that accepts XML submissions from external clients. An unauthenticated attacker with network access (AV:N/AC:L/PR:N/UI:N) can submit crafted XML, achieving high confidentiality impact (C:H) with a changed scope (S:C), as scored at CVSS 8.6. Successful exploitation allows the attacker to extract data from the host system, such as local files, without requiring privileges, user interaction, or impacting integrity or availability.
Mitigation is available via upgrade to version 1.7.4, which patches the XSLT transform components. Relevant details are documented in the GitHub security advisory (GHSA-8c3x-hq82-gjcm), the commit fixing the issue (3560de2f486d688a3ddcf4aa54d8bdacea380c3d), and the release comparison between 1.7.3 and 1.7.4. No workarounds are known.
Details
- CWE(s)