CVE-2024-52007: HAPI FHIR XXE Vulnerability

CVE-2024-52007 Overview

CVE-2024-52007 affects HAPI FHIR, the Java implementation of the HL7 FHIR standard for healthcare interoperability. XSLT parsing components within org.hl7.fhir.core accept XML input without disabling external entity resolution. An attacker who can submit XML to a host running the library can include a malicious DTD that references local files. The processed XML can return data read from the host filesystem, including files such as /etc/passwd. This issue extends an incomplete fix for GHSA-6cr6-ph3p-f5rf, tracked in pull requests #1571 and #1717. The flaw is classified under CWE-611: XML External Entity Reference.

Critical Impact
Remote unauthenticated attackers can exfiltrate arbitrary files from healthcare systems processing untrusted FHIR XML payloads.

Affected Products

HAPI FHIR org.hl7.fhir.core versions prior to 6.4.0
Healthcare applications embedding the HL7 FHIR Core libraries for XSLT parsing
FHIR endpoints accepting XML submissions from external clients

Discovery Timeline

2024-11-08 - CVE-2024-52007 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-52007

Vulnerability Analysis

The vulnerability resides in XSLT parsing routines used across multiple components of org.hl7.fhir.core. These routines invoke Java XML parsers without setting the secure-processing features that disable Document Type Definition (DTD) processing and external entity resolution. When the parser encounters a <!DOCTYPE> declaration with an <!ENTITY> referencing a SYSTEM URI, it dereferences the URI and substitutes the entity contents into the parsed document. Healthcare workloads often ingest XML directly from partner systems, so the attack surface is exposed wherever FHIR resources arrive as XML rather than JSON.

Root Cause

The root cause is the absence of XXE-hardening configuration on DocumentBuilderFactory, SAXParserFactory, and TransformerFactory instances within the XSLT processing path. The earlier patches in #1571 and #1717 addressed some parsing entry points but missed the XSLT-driven code paths. Without features such as FEATURE_SECURE_PROCESSING, disallow-doctype-decl, and disabled external general and parameter entities, the parser defaults to resolving any referenced resource.

Attack Vector

An attacker submits a crafted XML payload to any FHIR endpoint that processes XML through the affected XSLT routines. The payload defines an external entity pointing to a local file path or an attacker-controlled URL. When the library parses and transforms the document, the entity is dereferenced and its content is returned within the response, written to logs, or transmitted via out-of-band requests. The OWASP XML External Entity Prevention Cheat Sheet documents the standard payload structure, where a SYSTEM entity declaration references a host resource such as /etc/passwd to retrieve file contents.

Detection Methods for CVE-2024-52007

Indicators of Compromise

Inbound XML payloads containing <!DOCTYPE> declarations or <!ENTITY> definitions referencing SYSTEM URIs
Outbound DNS or HTTP requests from FHIR servers to unfamiliar hosts originating from the Java process
Application logs containing fragments of sensitive system files such as /etc/passwd or configuration files
Java stack traces referencing TransformerFactory, DocumentBuilder, or SAXParser correlated with external XML submissions

Detection Strategies

Inspect FHIR XML traffic at the application gateway for DTD and entity declarations and block any request containing them
Enable verbose XML parser logging in staging environments to capture entity resolution events
Run Software Composition Analysis (SCA) against build artifacts to flag org.hl7.fhir.core versions below 6.4.0

Monitoring Recommendations

Forward FHIR server access logs and JVM telemetry to a centralized data lake for correlation with outbound network connections
Alert on unexpected file reads by the FHIR application user against sensitive paths
Track egress traffic from healthcare integration servers to detect data exfiltration over HTTP, FTP, or DNS

How to Mitigate CVE-2024-52007

Immediate Actions Required

Upgrade org.hl7.fhir.core to version 6.4.0 or later across all dependent services
Inventory all internal applications that embed HAPI FHIR libraries and identify XML ingestion paths
Restrict FHIR XML endpoints to authenticated partners and validate content types
Review recent application logs for evidence of DTD or external entity processing

Patch Information

The maintainers addressed the issue in release version 6.4.0 of org.hl7.fhir.core. The fix completes the earlier remediation tracked in GitHub Issue #1571 and Pull Request #1717. Details are documented in GHSA-gr3c-q7xf-47vh. The advisory states that no workarounds exist, making the upgrade the only supported remediation path.

Workarounds

No vendor-supported workarounds exist; upgrading to 6.4.0 is required
As a compensating control, place a WAF or XML schema validator in front of FHIR endpoints to strip DTD declarations before requests reach the library
Limit network egress from FHIR servers to known destinations to reduce out-of-band exfiltration risk

bash

# Maven dependency update to the patched version
# pom.xml
# <dependency>
#   <groupId>ca.uhn.hapi.fhir</groupId>
#   <artifactId>org.hl7.fhir.core</artifactId>
#   <version>6.4.0</version>
# </dependency>

mvn versions:set-property -Dproperty=hapi-fhir.version -DnewVersion=6.4.0
mvn dependency:tree | grep org.hl7.fhir.core