XML external entity injection in gematik app-referencevalidator
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to `XML External Entities` attack due to insecure defaults of the used Woodstox WstxInputFactory. A malicious XML resource can lead to network requests issued by referencevalidator and thus to a `Server Side Request Forgery` attack. The vulnerability impacts applications which use referencevalidator to process XML resources from untrusted sources. The problem has been patched with the 2.5.1 version of the referencevalidator. Users are strongly recommended to update to this version or a more recent one. A pre-processing or manual analysis of input XML resources on existence of DTD definitions or external entities can mitigate the problem.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gematik | app-referencevalidator | before 2.5.1 | 2.5.1 | Patch available | CNA |
| — | de.gematik.refv.commons:commons (Maven) | before 2.5.1 | 2.5.1 | Patch available | GHSA-68j8-fp38-p48q |
- app-referencevalidator Vendorgematik Affected before 2.5.1 Fixed in 2.5.1 Patch available CNA
- de.gematik.refv.commons:commons (Maven) Vendor— Affected before 2.5.1 Fixed in 2.5.1 Patch available GHSA-68j8-fp38-p48q
Remediation
- Fix · CNA app-referencevalidator (gematik) Fixed in 2.5.1
- Fix · GHSA-68j8-fp38-p48q de.gematik.refv.commons:commons (Maven) Fixed in 2.5.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-46984
- 2026-10-03 Alias added: GHSA-68j8-fp38-p48q
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Advisory 2
Other 7
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory
- https://github.com/gematik/app-referencevalidator/releases/tag/2.5.1
- https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
- https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)
- https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)#
- https://github.com/gematik/app-referencevalidator/commit/d6d27613fab7a8dd08534946f29e0c51f319cad6
- https://github.com/gematik/app-referencevalidator
Sources
- CVE-2024-46984 · CVE Program
- CVE-2024-46984 · NVD
- FIRST EPSS
- GHSA-68j8-fp38-p48q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences