HL7 FHIR IG Publisher XML External Entity Injection Vulnerability

A vulnerability allowing XML external entity (XXE) injection has been identified in the HL7 FHIR IG Publisher tool, in versions prior to 1.7.4. This issue arises from XSLT transformations that can be manipulated with a malicious XML file containing a harmful DTD tag. The exploitation of this vulnerability could lead to the disclosure of data from the host system. This issue is particularly concerning in scenarios where the FHIR IG Publisher is used in an environment that accepts XML submissions from external clients.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive data from the host system, through XML external entity injection.

Remediation

Users can upgrade to HL7 FHIR IG Publisher version 1.7.4 or later to address this vulnerability. The updated version is available on the official HL7 FHIR IG Publisher GitHub repository.