CVE-2018-8038: Apache CXF Fediz XML Parsing Vulnerability
Summary
CVE-2018-8038: Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when pa... Affects org.apache.cxf.fediz:fediz-spring versions < 1.4.4. Fixed in 1.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF Fediz is an open-source library that provides support for federated identity management in Java applications. It offers plugins for integrating with various identity providers and enables secure authentication and authorization. However, versions prior to 1.4.4 are susceptible to a high severity vulnerability that allows for the parsing of XML-based parameters containing Document Type Declarations (DTDs). This vulnerability affects the following packages: org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3.
Vulnerability Detail
The vulnerability arises from the failure to fully disable DTDs during XML parsing in Apache CXF Fediz. This can lead to various security issues, including entity expansion attacks, external entity injection, and denial of service attacks. Attackers can exploit this vulnerability to gain unauthorized access, manipulate XML data, or cause the application to consume excessive resources. The vulnerability is rated as high severity.
How To Fix
Minimum fixed version
1.4.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a temporary workaround is to manually disable DTD processing in the application's XML parser configuration. This can be achieved by setting the 'javax.xml.parsers.DocumentBuilderFactory' system property to a secure value that disallows DTDs. Here's an example of how to implement this workaround in Java:
System.setProperty("javax.xml.parsers.DocumentBuilderFactory", "com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl");
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
Please note that this workaround may have implications on the functionality of the application and should only be considered as a temporary measure until the upgrade can be performed.
Conclusion
The vulnerability in Apache CXF Fediz prior to version 1.4.4 can lead to serious security issues. It is crucial to upgrade to the fixed version or apply the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf.fediz:fediz-spring →
FAQ
Apache CXF Fediz is an open-source library for federated identity management in Java applications. It provides plugins for integrating with identity providers and enables secure authentication and authorization.
Versions of Apache CXF Fediz prior to 1.4.4 are affected by this vulnerability.
This vulnerability can be exploited by attackers to gain unauthorized access, manipulate XML data, or cause denial of service attacks.
To fix this vulnerability, upgrade to Apache CXF Fediz version 1.4.4 or later.
Yes, a temporary workaround is to manually disable DTD processing in the application's XML parser configuration.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf.fediz:fediz-spring.
