XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.
Summary
The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag `( ]>` could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML. A previous release provided an incomplete solution revealed by new testing. This issue has been patched as of version 1.7.4. No known workarounds are available.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HL7 | fhir-ig-publisher | before 1.7.4 | 1.7.4 | Patch available | CNA |
| — | org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli (Maven) | before 1.7.4 | 1.7.4 | Patch available | GHSA-8c3x-hq82-gjcm |
| — | org.hl7.fhir.publisher:org.hl7.fhir.publisher.core (Maven) | before 1.7.4 | 1.7.4 | Patch available | GHSA-8c3x-hq82-gjcm |
- fhir-ig-publisher VendorHL7 Affected before 1.7.4 Fixed in 1.7.4 Patch available CNA
- org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli (Maven) Vendor— Affected before 1.7.4 Fixed in 1.7.4 Patch available GHSA-8c3x-hq82-gjcm
- org.hl7.fhir.publisher:org.hl7.fhir.publisher.core (Maven) Vendor— Affected before 1.7.4 Fixed in 1.7.4 Patch available GHSA-8c3x-hq82-gjcm
Remediation
- Fix · CNA fhir-ig-publisher (HL7) Fixed in 1.7.4
- Fix · GHSA-8c3x-hq82-gjcm org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli (Maven) Fixed in 1.7.4 Advisory →
- Fix · GHSA-8c3x-hq82-gjcm org.hl7.fhir.publisher:org.hl7.fhir.publisher.core (Maven) Fixed in 1.7.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-52807
- 2026-10-03 Alias added: GHSA-8c3x-hq82-gjcm
References
Other 5
- https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-8c3x-hq82-gjcm
- https://github.com/HL7/fhir-ig-publisher/commit/3560de2f486d688a3ddcf4aa54d8bdacea380c3d
- https://github.com/HL7/fhir-ig-publisher/compare/1.7.3...1.7.4
- https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5
- https://github.com/HL7/fhir-ig-publisher
More HL7 vulnerabilities
- TI-2023-09835 HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files… CVSS 3.1HIGH 8.1
- TI-2014-04450 CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA… CVSS 2.0MEDIUM 4.3
- TI-2014-03138 CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially… CVSS 2.0MEDIUM 4.3
- TI-2014-03137 Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows… CVSS 2.0MEDIUM 4.3
- TI-2025-18106 The HL7 FHIR IG publisher may potentially expose GitHub repo user and credential information CVSS 3.1MEDIUM 4.2
Sources
- CVE-2024-52807 · CVE Program
- CVE-2024-52807 · NVD
- FIRST EPSS
- GHSA-8c3x-hq82-gjcm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences