CVE-2022-0239: Stanford CoreNLP XXE injection in XML parsing

Executive brief

Stanford CoreNLP, a widely used natural language processing library, is vulnerable to a security flaw that allows attackers to manipulate how the software processes XML data. By submitting specially crafted files, an attacker could potentially read sensitive files from the server, access internal network resources, or cause a service outage. This could lead to the exposure of confidential business data or disruption of automated text analysis workflows.

Technical details

Stanford CoreNLP (versions 4.3.2 and earlier) is vulnerable to an XML External Entity (XXE) injection vulnerability (CWE-611). The root cause is the improper restriction of XML external entity references when parsing XML documents. A remote, unauthenticated attacker can exploit this by sending a malicious XML payload to an endpoint that utilizes the vulnerable library. Successful exploitation can lead to the disclosure of local files (arbitrary file read), server-side request forgery (SSRF), and denial-of-service (DoS) attacks. The vulnerability has been addressed in version 4.4.0.

Affected products

• Stanford NLP Group CoreNLP <= 4.3.2

Timeline

• 2022-01-17: advisory: NVD published CVE-2022-0239
• 2022-01-21: advisory: GitHub Advisory published
• 2022-01-21: patched: Version 4.4.0 released

References

• https://api.github.com/users/RainSignal
• https://github.com/RainSignal
• https://api.github.com/users/RainSignal/gists%7B/gist_id%7D
• https://api.github.com/users/RainSignal/repos
• https://avatars.githubusercontent.com/u/101503193?v=4
• https://api.github.com/users/RainSignal/events%7B/privacy%7D