CVE-2014-3004: Improper Restriction of XML External Entity Reference in Castor
Summary
CVE-2014-3004: Improper Restriction of XML External Entity Reference in Castor. Affects org.codehaus.castor:castor versions < 1.3.3. Fixed in 1.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Castor is an open-source data binding framework for Java. It allows developers to map Java objects to XML and vice versa. Castor supports various XML technologies, including SAX Parser. The Xerces SAX Parser is the default configuration in Castor versions prior to 1.3.3. This vulnerability arises from an improper restriction of XML External Entity (XXE) reference in the Xerces SAX Parser. Attackers can exploit this vulnerability by crafting a malicious XML document, leading to potential XXE attacks.
Vulnerability Detail
The default configuration of the Xerces SAX Parser in Castor before version 1.3.3 enables context-dependent attackers to conduct XML External Entity (XXE) attacks. By leveraging this vulnerability, an attacker can manipulate the processing of XML documents, potentially leading to information disclosure, denial of service, or server-side request forgery. The vulnerability is assigned CVE-2014-3004 and has a severity level of MODERATE according to the Common Vulnerability Scoring System (CVSS). The vulnerability is categorized under CWE-611.
How To Fix
Minimum fixed version
1.3.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Castor to mitigate the risk of XXE attacks.
Conclusion
The vulnerability in Castor versions prior to 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks. To mitigate this risk, it is recommended to upgrade to Castor version 1.3.3 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.codehaus.castor:castor →
FAQ
Castor is an open-source data binding framework for Java that allows developers to map Java objects to XML and vice versa.
XML External Entity (XXE) attack is a type of attack where an attacker can manipulate the processing of XML documents by exploiting vulnerabilities in XML parsers. This can lead to information disclosure, denial of service, or server-side request forgery.
This vulnerability has a severity level of MODERATE according to the Common Vulnerability Scoring System (CVSS).
To fix this vulnerability, you need to upgrade Castor to version 1.3.3 or later. Make sure to update your project's dependency on the 'org.codehaus.castor:castor' package.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of Castor.
