CVE-2013-7315: XML External Entity (XXE) issue in org.springframework:spring-oxm
Summary
CVE-2013-7315: Missing XML Validation in Spring Framework. Affects org.springframework:spring-oxm versions < 3.2.4.RELEASE. Fixed in 3.2.4.RELEASE. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2013-7315 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The org.springframework:spring-oxm package is a part of the Spring Framework, which is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The spring-oxm module specifically focuses on providing Object/XML Mapping (OXM) support, allowing developers to convert between Java objects and XML representations. This vulnerability affects versions before 3.2.4.RELEASE of the package.
Vulnerability Detail
The vulnerability in org.springframework:spring-oxm is due to a missing XML validation in the Spring MVC component of the Spring Framework. Specifically, versions before 3.2.4.RELEASE and 4.0.0.M1 through 4.0.0.M2 do not disable external entity resolution for the StAX XMLInputFactory. This allows context-dependent attackers to exploit the vulnerability by crafting malicious XML with JAXB, leading to various security issues:
-
Arbitrary File Reading: Attackers can read arbitrary files on the system, potentially exposing sensitive information.
-
Denial of Service: Attackers can cause a denial of service by crafting XML that triggers resource exhaustion.
-
CSRF Attacks: Attackers can conduct Cross-Site Request Forgery (CSRF) attacks by leveraging the vulnerability in the XML parsing process.
It is important to note that this vulnerability is different from CVE-2013-4152, although they share some similarities.
How To Fix
Minimum fixed version
3.2.4.RELEASE
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually disable external entity resolution for the StAX XMLInputFactory in their code. Here is an example of how to achieve this in Java:
XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
By setting the IS_SUPPORTING_EXTERNAL_ENTITIES property to false, the vulnerability can be mitigated. However, it is strongly recommended to apply the official fix by upgrading to a fixed version of the package.
Conclusion
The org.springframework:spring-oxm package is vulnerable to an XML External Entity (XXE) issue, which can lead to arbitrary file reading, denial of service, and CSRF attacks. It is crucial for developers to upgrade to version 3.2.4.RELEASE or later to mitigate this vulnerability. Applying the official fix ensures the proper disabling of external entity resolution for the StAX XMLInputFactory. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-oxm →
FAQ
This vulnerability allows attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks. It can lead to unauthorized access to sensitive information, system instability, and potential exploitation of user sessions.
No, only versions before 3.2.4.RELEASE and 4.0.0.M1 through 4.0.0.M2 are affected by this vulnerability.
While specific exploits may not be publicly available, the vulnerability has the potential to be exploited by crafting malicious XML payloads.
Yes, upgrading to version 3.2.4.RELEASE or later of the org.springframework:spring-oxm package includes the necessary fix to mitigate this vulnerability.
Yes, you can manually disable external entity resolution for the StAX XMLInputFactory in your code as a temporary workaround. However, it is recommended to apply the official fix by upgrading to a fixed version of the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-oxm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
