Description
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Karaf | Any Apache Karaf version prior to 4.1.7 and 4.2.2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
brianwrf/CVE-2018-11788 ★ 37 · Jan 6, 2019
Apache Karaf XXE Vulnerability (CVE-2018-11788)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.karaf.specs:org.apache.karaf.specs.java.xml | >= 4.2.0, < 4.2.2 | 4.2.2 | GHSA-92wj-x78c-m4fx |
| Maven | org.apache.karaf.specs:org.apache.karaf.specs.java.xml | < 4.1.7 | 4.1.7 | GHSA-92wj-x78c-m4fx |