CVE-2018-1307: Apache juddi-client vulnerable to XML External Entity (XXE)
Summary
CVE-2018-1307: Apache juddi-client vulnerable to XML External Entity (XXE). Affects org.apache.juddi:juddi-client versions >= 3.2, < 3.3.5. Fixed in 3.3.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache juddi-client is a Java library that provides a client interface for interacting with UDDI (Universal Description, Discovery, and Integration) registries. It allows users to parse and mediate XML documents into UDDI data structures. This vulnerability affects versions 3.2 through 3.3.4 of the juddi-client library.
Vulnerability Detail
The juddi-client library lacks proper protections against XML External Entity (XXE) attacks and entity expansion. This vulnerability can be exploited by an attacker to read arbitrary files on the server or launch denial-of-service attacks. The issue arises when using the WADL2Java or WSDL2Java classes, which parse XML documents without sufficient validation and sanitization. The impact of this vulnerability is high, as it can lead to unauthorized access to sensitive information and disruption of services.
How To Fix
Minimum fixed version
3.3.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 3.3.5 is not feasible, a temporary workaround is to implement custom input validation and sanitization when parsing XML documents using the WADL2Java or WSDL2Java classes. This can involve restricting external entity references, disabling DTD processing, and using secure XML parsers. Here is an example of how to disable DTD processing in Java:
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
Please note that this workaround may not provide complete protection and upgrading to the latest version is still recommended.
Conclusion
The Apache juddi-client library versions 3.2 through 3.3.4 are vulnerable to XML External Entity (XXE) attacks. This can lead to unauthorized access to sensitive information and disruption of services. It is recommended to upgrade to version 3.3.5 of the library to mitigate this vulnerability. If upgrading is not possible, implementing custom input validation and sanitization can provide temporary protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.juddi:juddi-client →
FAQ
Apache juddi-client is a Java library that provides a client interface for interacting with UDDI registries. It allows users to parse and mediate XML documents into UDDI data structures.
An XML External Entity (XXE) attack is a type of security vulnerability that allows an attacker to read arbitrary files on the server or launch denial-of-service attacks by exploiting the processing of external entities in XML documents.
This vulnerability can lead to unauthorized access to sensitive information and disruption of services. An attacker can exploit it to read arbitrary files on the server or launch denial-of-service attacks.
To fix this vulnerability, upgrade to version 3.3.5 of the juddi-client library. Update the library in your project's dependencies and recompile the code.
If upgrading to version 3.3.5 is not feasible, you can implement custom input validation and sanitization when parsing XML documents using the WADL2Java or WSDL2Java classes. This involves restricting external entity references, disabling DTD processing, and using secure XML parsers.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.juddi:juddi-client.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.