CVE-2023-42445 (gradle)

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML …

attack automation build cases cve development disabled entities exfiltration external files focus gradle language local oob out of band parsing remote server server support text text files tool xml xxe