CVE-2019-3773: XML External Entity Injection in org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
Summary
CVE-2019-3773: Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml. Affects org.springframework.ws:spring-ws across 2 version ranges.
< 2.4.4
>= 3.0.0, < 3.0.6
Fixed in 2.4.4 or 3.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.springframework.ws:spring-ws and org.springframework.ws:spring-xml packages are part of the Spring Web Services project. Spring Web Services is a framework for building SOAP-based web services. It provides support for XML messaging, including marshalling and unmarshalling XML payloads. The vulnerable versions of these packages are 2.4.3, 3.0.4, and older unsupported versions. These versions are susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Vulnerability Detail
The vulnerability in org.springframework.ws:spring-ws and org.springframework.ws:spring-xml allows for XML External Entity Injection (XXE) attacks. This means that an attacker can manipulate XML input to access local files, perform remote requests, or launch denial-of-service attacks. The vulnerability arises from the failure to properly validate and sanitize XML input, allowing malicious entities to exploit the XML parsing functionality. This can lead to unauthorized access, data leakage, and potential system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4 -
>= 3.0.0, < 3.0.63.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed versions mentioned above to address the issue.
Conclusion
The XML External Entity Injection vulnerability in org.springframework.ws:spring-ws and org.springframework.ws:spring-xml can have severe consequences, including unauthorized access, data leakage, and potential system compromise. It is crucial to update to the fixed versions (2.4.4 or later for org.springframework.ws:spring-ws and 3.0.6 or later for org.springframework.ws:spring-xml) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.ws:spring-ws →
FAQ
XML External Entity Injection (XXE) is a type of attack that exploits vulnerabilities in XML parsers. It allows an attacker to manipulate XML input to access local files, perform remote requests, or launch denial-of-service attacks.
This vulnerability can lead to unauthorized access, data leakage, and potential system compromise. Attackers can exploit the vulnerability to access sensitive information, modify XML data, or disrupt the functioning of the application.
Are all versions of org.springframework.ws:spring-ws and org.springframework.ws:spring-xml affected?
No, only versions 2.4.3, 3.0.4, and older unsupported versions are affected. It is recommended to upgrade to the fixed versions mentioned above to mitigate the vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to update to the fixed versions to address the issue.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
