Is CVE-2024-34345 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-34345 being exploited in the wild.

How severe is CVE-2024-34345?

Low severity, with a CVSS score of 3.1, published 8 May 2024.

Which products and versions are affected?

Cyclonedx-Library 6.7.0; @cyclonedx/cyclonedx-library (npm) SEMVER:introduced=6.7.0,fixed=6.7.1.

Is there a fix for CVE-2024-34345?

Yes. @cyclonedx/cyclonedx-library (npm): upgrade to 6.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-34345 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-34345?

Check whether you run Cyclonedx-Library or @cyclonedx/cyclonedx-library (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-34345: CycloneDX cyclonedx-library XXE in XML Validator

CVE-2024-34345 · Severity: low · CVSS 3.1 · Published 2024-05-08

The CycloneDX JavaScript library, which is used to handle Software Bill of Materials (SBOM) data, contains a vulnerability in its XML validation component. If an application uses this library to validate a maliciously crafted XML file, an attacker could potentially read sensitive files from the server or cause other unintended behaviors. This could lead to the exposure of internal system data or configuration files.

Vendors: CycloneDX, npm.

Quick answers

Is CVE-2024-34345 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-34345 being exploited in the wild.
How severe is CVE-2024-34345?: Low severity, with a CVSS score of 3.1, published 8 May 2024.
Which products and versions are affected?: Cyclonedx-Library 6.7.0; @cyclonedx/cyclonedx-library (npm) SEMVER:introduced=6.7.0,fixed=6.7.1.
Is there a fix for CVE-2024-34345?: Yes. @cyclonedx/cyclonedx-library (npm): upgrade to 6.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-34345 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-34345?: Check whether you run Cyclonedx-Library or @cyclonedx/cyclonedx-library (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@cyclonedx/cyclonedx-library (npm): upgrade to 6.7.1 or later
```
npm install @cyclonedx/cyclonedx-library@6.7.1
```

Technical details

An Improper Restriction of XML External Entity Reference (XXE) vulnerability (CWE-611) exists in the @cyclonedx/cyclonedx-library within the XmlValidator component. The vulnerability was introduced in version 6.7.0 when the library failed to disable external entity resolution during XML validation. A remote, unauthenticated attacker can exploit this by providing a forged CycloneDX BOM file containing a DOCTYPE declaration with a SYSTEM entity pointing to local files (e.g., /etc/passwd). When the validator processes this input, it may resolve the entity and include the file contents in its output or behavior. The issue is resolved in version 6.7.1 by preventing the parser from resolving external entities.

Affected products

CycloneDX @cyclonedx/cyclonedx-library 6.7.0

Identifiers

CVE-2024-34345
GHSA-38gf-rh2w-gmj7

Timeline

2024-05-07: patched: Fix merged into main branch via PR 1063
2024-05-08: disclosed: GitHub Security Advisory published
2024-05-14: advisory: NVD published CVE-2024-34345

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.