CVE-2014-3623: Improper Authentication in Apache WSS4J
Summary
CVE-2014-3623: Improper Authentication in Apache WSS4J. Affects org.apache.ws.security:wss4j versions < 1.6.17. Fixed in 1.6.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache WSS4J is a Java library for implementing the OASIS Web Services Security (WS-Security) standard. It provides functions for securing SOAP messages by adding digital signatures, encrypting message parts, and verifying signatures and decryption. The library is widely used in Apache CXF, an open-source services framework for building and developing web services. This vulnerability affects versions of Apache WSS4J prior to 1.6.17 and 2.x prior to 2.0.2, as well as Apache CXF versions 2.7.x prior to 2.7.13 and 3.0.x prior to 3.0.2.
Vulnerability Detail
The vulnerability in Apache WSS4J arises when using the TransportBinding, as it fails to properly enforce the SAML SubjectConfirmation method security semantics. This flaw allows remote attackers to conduct spoofing attacks by exploiting unspecified vectors. The exact details of the attack vectors are not disclosed in the vulnerability report.
How To Fix
Minimum fixed version
1.6.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is provided in the vulnerability report. It is recommended to follow the steps mentioned in the 'how_to_fix' section to upgrade to a fixed version of the affected packages.
Conclusion
The vulnerability in Apache WSS4J can lead to spoofing attacks, potentially compromising the security of web services. It is crucial to upgrade to a fixed version of the affected packages to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ws.security:wss4j →
FAQ
Apache WSS4J is a Java library for implementing the OASIS Web Services Security (WS-Security) standard. It provides functions for securing SOAP messages by adding digital signatures, encrypting message parts, and verifying signatures and decryption.
Apache CXF is an open-source services framework for building and developing web services. It is widely used in conjunction with Apache WSS4J.
This vulnerability allows remote attackers to conduct spoofing attacks, potentially leading to unauthorized access or manipulation of sensitive data.
The vulnerability report does not disclose the specific details of the attack vectors, so the existence of known exploits is not mentioned.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ws.security:wss4j.
