CVE-2014-0119: Missing XML Validation in Apache Tomcat
Summary
CVE-2014-0119: Missing XML Validation in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
< 6.0.40
>= 7.0.0, < 7.0.54
>= 8.0.0, < 8.0.6
Fixed in 6.0.40, 7.0.54 or 8.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. This vulnerability affects versions of Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6. The vulnerability arises from a lack of proper constraint on the class loader that accesses the XML parser used with an XSLT stylesheet. This allows remote attackers to read arbitrary files or access files associated with different web applications on a single Tomcat instance.
Vulnerability Detail
The vulnerability in Apache Tomcat allows remote attackers to exploit two different scenarios. Firstly, by providing an XML external entity declaration in conjunction with an entity reference, an attacker can read arbitrary files via a crafted web application, resulting in an XML External Entity (XXE) issue. Secondly, an attacker can read files associated with different web applications on a single Tomcat instance by using a crafted web application. This vulnerability poses a moderate risk as it can lead to unauthorized access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.0.406.0.40 -
>= 7.0.0, < 7.0.547.0.54 -
>= 8.0.0, < 8.0.68.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by disabling external entity resolution in the XML parser configuration. This can be achieved by modifying the Tomcat configuration file to set the 'externalEntityResolving' attribute to 'false' in the 'org.apache.tomcat.util.digester.Digester' class.
Conclusion
The missing XML validation vulnerability in Apache Tomcat can allow remote attackers to read arbitrary files or access files associated with different web applications. It is crucial to upgrade to the fixed versions or apply the temporary workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container used to deploy Java-based web applications.
Versions of Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 are affected.
An XML External Entity (XXE) issue is a type of vulnerability that allows an attacker to read arbitrary files or execute remote requests.
This vulnerability poses a moderate risk as it can lead to unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to upgrade to Apache Tomcat version 6.0.40, 7.0.54, or 8.0.6 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
