CVE-2024-56525
Published: 24 February 2025
Description
In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin.
Security Summary
CVE-2024-56525 is an XML External Entity (XXE) vulnerability in the Public Knowledge Project's (PKP) Open Journal Systems (OJS), Open Monograph Press (OMP), and Open Preprint Server (OPS) platforms, affecting versions before 3.3.0.21 and 3.4.x before 3.4.0.8. The issue resides in the User XML Plugin upload functionality, where insufficient parsing of uploaded XML documents allows external entity expansion. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-276 (Incorrect Default Permissions). The vulnerability was published on 2025-02-24.
A user with Journal Editor role privileges can exploit this XXE flaw by uploading a specially crafted XML document via the User XML Plugin feature. Successful exploitation enables the attacker to create a new super admin role within the journal context and insert a backdoor plugin, potentially granting full administrative control over the affected journal instance.
Mitigation requires upgrading to OJS/OMP/OPS version 3.3.0.21 or later, or 3.4.0.8 or later, as detailed in the vendor advisory at https://openjournaltheme.com/user-xml-fatal-vulnerabilities-for-ojs-omp-ops-3-3-0-21-cve-2024-56525/. No additional workarounds are specified in available information.
Details
- CWE(s)