CVE-2014-5325: Direct Web Remoting (DWR) XML External Entity (XXE) Vulnerability
Summary
CVE-2014-5325: Exposure of Sensitive Information to an Unauthorized Actor in Direct Web Remoting. Affects org.directwebremoting:dwr across 2 version ranges.
< 2.0.11
>= 3.0.M1, < 3.0.RC3
Fixed in 2.0.11 or 3.0.RC3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Direct Web Remoting (DWR) is a Java library that enables developers to create Ajax applications by allowing JavaScript in a browser to interact with Java on the server. It provides a simple way to expose Java objects to JavaScript and vice versa. DWR versions 2.0.10 and 3.x through 3.0.RC2 are affected by an XML External Entity (XXE) vulnerability.
Vulnerability Detail
The vulnerability exists in the (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions of DWR. Remote attackers can exploit this vulnerability by sending malicious DOM data containing an XML external entity declaration along with an entity reference. This can lead to the disclosure of sensitive information as the attacker can read arbitrary files on the server. The vulnerability is classified as CWE-200 and has a severity level of MODERATE.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.112.0.11 -
>= 3.0.M1, < 3.0.RC33.0.RC3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of DWR.
Conclusion
The Direct Web Remoting (DWR) XML External Entity (XXE) vulnerability allows remote attackers to read arbitrary files on the server by exploiting the vulnerable functions in DWR. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of DWR. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.directwebremoting:dwr →
FAQ
Direct Web Remoting (DWR) is a Java library that allows JavaScript in a browser to interact with Java on the server, enabling the creation of Ajax applications.
An XML External Entity (XXE) vulnerability occurs when an application processes XML input that contains a reference to an external entity, which can be used to disclose sensitive information or perform other malicious actions.
This vulnerability is classified as MODERATE in terms of severity.
No, only DWR versions 2.0.10 and 3.x through 3.0.RC2 are affected. Later versions have been fixed.
No, there is no known workaround. It is recommended to upgrade to the fixed versions of DWR.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.directwebremoting:dwr.
