CVE-2020-24379: 
NixOS vulnerability analysis and mitigation

The vulnerability CVE-2020-24379 affects the WebDAV implementation in Yaws web server versions 1.81 to 2.0.7. This security flaw was discovered in 2020 and involves an XML External Entity (XXE) injection vulnerability in the WebDAV module (NVD, Debian Security). The vulnerability received a CVSS v3.1 base score of 9.8 (Critical), indicating its severe nature (NVD).

The vulnerability exists in the WebDAV module of Yaws, which uses the Xmerl Erlang library for parsing messages of methods LOCK, PROPFIND, and PROPPATCH. The library's unsafe defaults in XML parsing allow for XXE injection attacks. The vulnerable code was introduced in commit 16299b3 on May 16, 2005. The WebDAV functionality must be enabled in the configuration file (dav = true) for the vulnerability to be exploitable (Vuln.be).

The vulnerability allows remote attackers to execute XML External Entity (XXE) injection attacks when WebDAV is enabled. This could potentially lead to unauthorized access to sensitive files, server-side request forgery, denial of service, or other security issues typical of XXE vulnerabilities (Ubuntu Security).

The vulnerability is exploitable remotely without requiring authentication. A proof-of-concept exploit has been published demonstrating the vulnerability through the WebDAV LOCK method. The exploit allows attackers to retrieve data through entity injection in the d:href element (Vuln.be, GitHub PoC).

The vulnerability has been fixed in version 2.0.8+dfsg-3 and later releases. Various distributions have released security updates: Ubuntu 18.04 LTS users should upgrade to version 2.0.4+dfsg-2ubuntu0.1, Debian Buster users should upgrade to version 2.0.6+dfsg-1+deb10u1, and Debian Stretch users should upgrade to version 2.0.4+dfsg-1+deb9u1 (Ubuntu Notice, Debian LTS).