CVE-2024-51132

CRITICAL

HAPI FHIR < 6.4.0 - XML External Entity Injection via Crafted XML Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-51132. PoCs published by JAckLosingHeart.

AI-analyzed exploit summary This PoC demonstrates an XXE vulnerability in multiple HL7 FHIR libraries by loading a malicious XML file via the `Translations` class. The exploit can lead to SSRF or information leakage.

Description

An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

Exploits (1)

nomisec WORKING POC 1 stars
by JAckLosingHeart · poc
https://github.com/JAckLosingHeart/CVE-2024-51132-POC

This PoC demonstrates an XXE vulnerability in multiple HL7 FHIR libraries by loading a malicious XML file via the `Translations` class. The exploit can lead to SSRF or information leakage.

Classification
Working Poc 90%
Attack Type
Ssrf | Info Leak
Complexity
Trivial
Reliability
Reliable
Target: org.hl7.fhir libraries < 6.4.0
No auth needed
Prerequisites: Access to a vulnerable FHIR library version · Ability to provide a malicious XML file
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0185
EPSS Percentile 76.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-611
Status published
Products (9)
ca.uhn.hapi.fhir/org.hl7.fhir.convertors 0 - 6.4.0Maven
ca.uhn.hapi.fhir/org.hl7.fhir.dstu2 0 - 6.4.0Maven
ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may 0 - 6.4.0Maven
ca.uhn.hapi.fhir/org.hl7.fhir.dstu3 0 - 6.4.0Maven
ca.uhn.hapi.fhir/org.hl7.fhir.r4 0 - 6.4.0Maven
ca.uhn.hapi.fhir/org.hl7.fhir.r4b 0 - 6.4.0Maven
ca.uhn.hapi.fhir/org.hl7.fhir.r5 0 - 6.4.0Maven
ca.uhn.hapi.fhir/org.hl7.fhir.utilities 0 - 6.4.0Maven
ca.uhn.hapi.fhir/org.hl7.fhir.validation 0 - 6.4.0Maven
Published Nov 05, 2024
Tracked Since Feb 18, 2026