XML External Entity (XXE) Vulnerability in libspring-java: Risk of File Disclosure and Denial of Service
Summary
CVE-2014-0054: The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a d... Affects libspring-java versions < 3.0.6.RELEASE-13. Fixed in 3.0.6.RELEASE-13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a core component of the Spring Framework, widely used for building Java applications. It provides comprehensive infrastructure support for developing Java applications, including features for web applications, data access, and transaction management. The vulnerability in question affects versions of libspring-java prior to 3.0.6.RELEASE-13, allowing attackers to exploit XML processing capabilities.
Vulnerability Detail
The Jaxb2RootElementHttpMessageConverter in Spring MVC fails to disable external entity resolution, leading to an XML External Entity (XXE) vulnerability. This flaw allows remote attackers to read arbitrary files on the server, potentially causing a denial of service or conducting Cross-Site Request Forgery (CSRF) attacks through crafted XML payloads. This vulnerability stems from an incomplete fix for previous CVEs, including CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
How To Fix
Minimum fixed version
3.0.6.RELEASE-13
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling external entity processing in your XML parsers. This can often be done by configuring the XML parser settings in your application code. For example, if using JAXB, you can disable DTD processing as follows:
JAXBContext jaxbContext =
JAXBContext.newInstance(YourClass.class);
Unmarshaller unmarshaller = jaxbContext.createUnmarshaller();
Unmarshaller.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "none");
Unmarshaller.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "none");
Conclusion
The XXE vulnerability in libspring-java poses significant risks to applications using affected versions. It is crucial to update to the latest version to safeguard against potential attacks. Additionally, implementing workarounds can provide temporary relief until an upgrade is possible.
See every vulnerability recorded for libspring-java →
FAQ
An XXE vulnerability occurs when an XML parser processes external entities, allowing attackers to access files or services on the host system.
You can use tools like Vulert to check if your application is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, to receive real-time alerts.
The consequences include unauthorized file access, denial of service, and potential CSRF attacks, which can compromise the security of your application.
Yes, you can mitigate the risk by disabling external entity processing in your XML parsers, as described in the workaround section.
Detailed information can be found in the CVE database, specifically under CVE-2014-0054, and related advisories.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
