CVE-2019-9843 : Security Advisory and Response

CVE-2019-9843 was published on March 15, 2019, and affects DiffPlug Spotless versions prior to 1.20.0 for the library and Maven plugin, as well as versions before 3.20.0 for the Gradle plugin. The vulnerability in the XML parser allowed for the retrieval of external entities over HTTP and HTTPS, potentially exposing file contents to a Man-in-the-Middle (MITM) attacker.

Understanding CVE-2019-9843

This CVE highlights a security flaw in the XML parser of DiffPlug Spotless versions prior to 1.20.0 and 3.20.0 for the library, Maven plugin, and Gradle plugin.

What is CVE-2019-9843?

Prior to specific versions of DiffPlug Spotless, the XML parser had a vulnerability that could be exploited by a MITM attacker to access file contents.

The Impact of CVE-2019-9843

The vulnerability allowed a potential MITM attacker to intercept and access file contents when a user executed a spotlessApply operation on an untrusted XML file.

Technical Details of CVE-2019-9843

This section delves into the technical aspects of the CVE.

Vulnerability Description

The flaw in the XML parser of affected DiffPlug Spotless versions allowed the retrieval of external entities over both HTTP and HTTPS, disregarding the resolveExternalEntities setting.

Affected Systems and Versions

DiffPlug Spotless versions prior to 1.20.0 (library and Maven plugin)
DiffPlug Spotless versions before 3.20.0 (Gradle plugin)

Exploitation Mechanism

The vulnerability could be exploited by a MITM attacker intercepting the communication between a user and the XML parser, potentially gaining access to file contents.

Mitigation and Prevention

Protecting systems from CVE-2019-9843 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update DiffPlug Spotless to version 1.20.0 for library and Maven plugin, and version 3.20.0 for the Gradle plugin
Avoid executing spotlessApply operations on untrusted XML files

Long-Term Security Practices

Implement secure coding practices to prevent XML-related vulnerabilities
Regularly monitor and update software dependencies

Patching and Updates

Ensure timely patching and updates of DiffPlug Spotless to mitigate the vulnerability.