XXE Vulnerability in org.hl7.fhir.publisher: Risk of Sensitive Data Leakage

Details

This security advisory concerns the org.hl7.fhir.publisher package, which is used to facilitate the publishing of FHIR implementation guides and resources. The package relies on XSLT transformations for processing XML files, making it dependent on XML parsing mechanisms. This dependency creates a vulnerability to External Entity (XXE) injection. An attacker can craft a malicious XML file containing a DTD tag; when processed by the vulnerable mechanism, this could lead to unauthorized exposure of sensitive data from the host system. The vulnerability is identified as CVE-2024-52807. Due to its critical role in healthcare applications utilizing FHIR standards, this risk can lead to severe data breaches and unauthorized access. Mitigation requires updating to a patched version (e.g., 1.7.4 or later). Furthermore, general prevention measures include configuring XML parsers to disable external entity processing and validating all XML inputs against strict schemas. The package's importance in the FHIR ecosystem mandates that developers treat this vulnerability with high priority to prevent potential system compromise.