CVE-2022-4245

What it actually does

The writeComment method in plexus-utils fails to sanitize input containing the --> sequence, allowing supplied text to close an XML comment prematurely and inject arbitrary XML markup into the generated document.

Why it matters to the business

Applications that use plexus-utils to generate XML may expose limited internal data or produce malformed documents that downstream parsers consume, potentially leading to information leakage or processing errors in build, configuration, or reporting pipelines.

How an attack unfolds

An attacker supplies a comment string containing --> followed by attacker-controlled XML elements; when the library writes the comment without escaping, the injected markup is emitted into the output XML and later parsed by an XML processor that may resolve external entities or execute other XML-based actions.

How to fix it

Upgrade codehaus-plexus/plexus-utils to the version containing commit fd36d8b80ba10955ef065230571ce2be2d4c1bbb; after the upgrade, recompile and redeploy all dependent artifacts.

How to confirm the fix worked

Confirm the presence of commit fd36d8b80ba10955ef065230571ce2be2d4c1bbb in the plexus-utils source tree or verify that the writeComment implementation now escapes or rejects --> sequences; run unit tests that supply malicious comment strings and assert that the output remains well-formed XML without injected content.

Typical attack path

1. Identify an application or build process that invokes XmlWriterUtil.writeComment with untrusted data.
2. Craft a comment payload containing the sequence --> followed by desired XML injection.
3. Submit the payload through the affected code path so the library emits the unsanitized comment.
4. Trigger parsing of the resulting XML document by a consumer that processes external entities or other injected constructs.

How to detect it

Review application logs for XML generation routines that accept user-controlled comment text; inspect generated XML files or network responses for unexpected --> sequences followed by additional markup; correlate build or runtime errors with XML parsing failures that reference external entities.

What your security team should do

• Apply the fixed plexus-utils commit to all builds and dependency manifests within the next sprint.
• Scan SBOMs and Maven/Gradle dependency trees for any remaining vulnerable plexus-utils versions.
• Add automated tests that exercise writeComment with comment-termination sequences to prevent regression.