CVE-2019-3772: XML External Entity Injection in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml
Summary
CVE-2019-3772: Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML da... Affects org.springframework.integration:spring-integration-xml across 3 version ranges.
< 4.3.19
>= 5.0.0, < 5.0.11
>= 5.1.0, < 5.1.2
Fixed in 4.3.19, 5.0.11 or 5.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml packages are part of the Spring Integration framework. Spring Integration is an open-source messaging framework that provides support for building enterprise integration solutions. The spring-integration-xml module enables XML processing capabilities, while the spring-integration-ws module provides integration with web services. These modules are widely used in Java applications for handling XML data and integrating with web services.
Vulnerability Detail
The vulnerability identified as CVE-2019-3772 is an XML External Entity Injection (XXE) vulnerability. It affects versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions of the Spring Integration framework. This vulnerability occurs when the framework receives XML data from untrusted sources. An attacker can exploit this vulnerability to read arbitrary files on the server or perform other malicious actions by including external entities in the XML data. This can lead to unauthorized access, data leakage, or denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.3.194.3.19 -
>= 5.0.0, < 5.0.115.0.11 -
>= 5.1.0, < 5.1.25.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to disable XML external entity resolution in the affected modules. This can be achieved by configuring the XML parsers used by the framework to disallow external entities. Here is an example of how to disable external entity resolution using the Woodstox XML parser in Spring Integration:
import com.ctc.wstx.stax.WstxInputFactory;
WstxInputFactory inputFactory = new WstxInputFactory();
inputFactory.setProperty(WstxInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
inputFactory.setProperty(WstxInputFactory.SUPPORT_DTD, false);
// Use the inputFactory in your XML processing code
Note that this workaround should be considered temporary, and upgrading to the fixed versions is the recommended long-term solution.
Conclusion
The XML External Entity Injection vulnerability in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml can lead to unauthorized access, data leakage, or denial of service. It is crucial to upgrade to the fixed versions of the affected packages (4.3.19, 5.0.11, or 5.1.2) or apply the temporary workaround of disabling external entity resolution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.integration:spring-integration-xml →
FAQ
XML External Entity Injection (XXE) is a vulnerability that allows an attacker to include external entities in XML data. These external entities can reference files on the server or perform other actions, leading to unauthorized access, data leakage, or denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
The potential consequences of this vulnerability include unauthorized access to sensitive data, data leakage, and denial of service. An attacker can exploit this vulnerability to read arbitrary files on the server or perform other malicious actions.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to patch the vulnerability as soon as possible to mitigate the risk.
Yes, fixed versions of the affected packages are available. It is recommended to upgrade to version 4.3.19, 5.0.11, or 5.1.2 of org.springframework.integration:spring-integration-xml and org.springframework.integration:spring-integration-ws to patch the vulnerability.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.