Full Disclosure mailing list archives
Re: XXE Injection in Spring Framework
From: Mark Thomas <mthomas () gopivotal com>
Date: Tue, 5 Nov 2013 12:47:23 +0000
On 04/11/2013 19:26, /-\\ndrew /\//ady wrote:
Hi, Was Pivotal informed about these advisories and was there any
collaboration from them?
The current stable is 3.2.4
Yes, Pivotal was informed of these issues by Alvaro Munoz of the HP Enterprise Security Team who discovered them and reported them responsibly to the Pivotal Security Team. Yes, there was collaboration between Alvaro Munoz, the Pivotal Security Team and the Spring developers as we worked through which vectors were an application responsibility, which were a framework responsibility and how each each was going to be addressed. I'd have to go back and check my archive in detail to be certain but from memory the vectors that were an application responsibility already had a warning in the documentation and that warning was expanded. Some new utility classes were also provided to make it easier for users to do the right thing. For the vectors the framework was responsible for, entity expansion was disabled by default (it was enabled by default in some cases - hence the vulnerability). Where an option to control entity expansion didn't previously exist one was added so that applications that were processing XML from trusted sources and wanted / needed to enable entity expansion could do so. See also: http://www.gopivotal.com/security/cve-2013-4152 http://seclists.org/fulldisclosure/2013/Aug/233 HTH, Mark Pivotal Security Team Lead
Thanks, A. On Saturday, November 02, 2013 07:04:59 AM MustLive wrote:Hello! I'll give you additional information concerning advisory XML External Entity (XXE) Injection in Spring Framework (http://securityvulns.ru/docs29758.html). ------------------------- Affected products: ------------------------- - 3.0.0 to 3.2.3 (Spring OXM & Spring MVC) - 4.0.0.M1 (Spring OXM) - 4.0.0.M1-4.0.0.M2 (Spring MVC) - Earlier unsupported versions may also be affected ------------------------- Affected vendors: ------------------------- Spring by Pivotal. ---------- Details: ---------- The Spring OXM wrapper doesn't disable external entity resolution when using the JAXB unmarshaller (SAXSource and StreamSource instances are vulnerable). Also Spring MVC processes user provided XML with JAXB in combination with a StAX XMLInputFactory without disabling external entity resolution. Besides standard vectors of attacks with XXE Injection vulnerabilities (such as local file inclusion), which are usually mentioned in
advisories,
XXE Injection also allows to conduct attacks on other sites. And with using DAVOSET (DDoS attacks via other sites execution tool) it's possible to automate such attacks. I wrote about such attacks in my 2012's article "Using XML External Entities (XXE) for attacks on other sites" (
http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2012-
August/008481.html) and 2013's "Using XXE vulnerabilities for attacks on other sites" (
http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2013-
August/008887.html). As I described in my articles, XXE vulnerabilities
can
be used for conducting CSRF and DoS attacks on other sites (and at using multiple web sites it's possible to conduct DDoS attacks). And my tool DAVOSET can be used for conducting such attacks via XXE vulnerabilities. In October I released video demonstration of DAVOSET: http://www.youtube.com/watch?v=RKi35-f346I So all vulnerable web applications with affected versions of Spring Framework can be used for attacks on other sites via XXE Injection. Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- XXE Injection in Spring Framework MustLive (Nov 02)
- Re: XXE Injection in Spring Framework /-\\ndrew /\//ady (Nov 05)
- <Possible follow-ups>
- Re: XXE Injection in Spring Framework Mark Thomas (Nov 05)