XXE via Unrestricted SAXON Transformer in HAPI FHIR

Executive Summary

This vulnerability exists in HAPI FHIR versions prior to 6.9.10 in the saxonTransform(...) methods of the org.hl7.fhir.utilities.XsltUtilities class. These methods instantiate a TransformerFactoryImpl without restricting ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET, which allows an attacker who can control or tamper with the transformed XML to perform XML External Entity (XXE) injection.

As a result, the attacker can cause local file disclosure or perform blind XXE or Server-Side Request Forgery (SSRF) attacks to arbitrary URLs accessible from the host running the software.

This issue is fixed in version 6.9.10 of HAPI FHIR.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to serious security impacts including unauthorized disclosure of local files on the server, which may contain sensitive information.

Additionally, it enables blind XXE or SSRF attacks, allowing attackers to make arbitrary requests from the vulnerable host to internal or external systems, potentially leading to further exploitation or data exfiltration.

Since the vulnerability requires no privileges or user interaction, it can be exploited remotely and easily, increasing the risk.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade HAPI FHIR to version 6.9.10 or later, where the issue has been fixed by restricting ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET in the TransformerFactoryImpl instantiation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in HAPI FHIR prior to version 6.9.10 allows XML External Entity (XXE) injection, which can lead to local file disclosure and blind XXE or SSRF attacks. Such security issues can potentially expose sensitive healthcare data or system information.

Since HAPI FHIR is used for healthcare interoperability and handles sensitive health information, exploitation of this vulnerability could impact compliance with regulations like HIPAA, which mandates the protection of patient data confidentiality and integrity.

Similarly, GDPR requires appropriate technical measures to protect personal data. This vulnerability could undermine those protections by allowing unauthorized data access or disclosure.

Therefore, failure to patch this vulnerability may result in non-compliance with such standards due to increased risk of data breaches.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for XML inputs that contain malicious DOCTYPE declarations or external entity references, which are typical indicators of XML External Entity (XXE) attacks.

On the system or application side, you can check if the affected versions of the org.hl7.fhir.utilities library (up to 6.9.9) are in use, as these versions instantiate an unhardened Saxon TransformerFactory without restrictions on external DTD or stylesheet access.

To detect exploitation attempts on your network, you can use network monitoring tools or intrusion detection systems (IDS) to look for unusual outbound HTTP requests triggered by XXE or SSRF attacks, especially requests to unexpected or external URLs.

Suggested commands include scanning XML files or inputs for DOCTYPE declarations and external entity references. For example, using grep on Linux systems:

• grep -r -i '<!DOCTYPE' /path/to/xml/files
• grep -r -i 'ENTITY' /path/to/xml/files

Additionally, you can use tools like xmlstarlet to parse XML files and detect external entity usage.

For runtime detection, enabling detailed logging in the application to capture XML transformation calls and monitoring for exceptions or unusual behavior related to TransformerFactory usage may help identify attempts to exploit this vulnerability.

Useful 0 Not Useful 0