XML External Entity (XXE) Injection in libspring-java
Summary
DSA-2842-1: libspring-java - several. Affects libspring-java versions < 3.0.6.RELEASE-6+deb7u1. Fixed in 3.0.6.RELEASE-6+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a library that provides a framework for building Java applications. It includes various modules for different functionalities, such as Spring MVC for web applications and Spring OXM for XML processing. This vulnerability affects libspring-java versions prior to 3.0.6.RELEASE-6+deb7u1 on Debian 7 (wheezy).
Vulnerability Detail
The vulnerability discovered in libspring-java is an XML External Entity (XXE) injection. This vulnerability allows an attacker to conduct Cross-Site Request Forgery (CSRF) and Denial of Service (DoS) attacks on other sites. The issue arises from the Spring OXM wrapper, which did not provide an option to disable entity resolution when using the JAXB unmarshaller. This vulnerability affects the following source implementations passed to the unmarshaller: DOMSource, StAXSource, SAXSource, and StreamSource. For DOMSource and StAXSource, the responsibility of protecting against XXE lies with the user code. However, for SAXSource and StreamSource, Spring processed external entities by default, creating this vulnerability. The issue has been resolved by disabling external entity processing by default and adding an option to enable it for users who need to process XML from a trusted source. Additionally, it was identified that Spring MVC processed user-provided XML with JAXB and a StAX XMLInputFactory without disabling external entity resolution. This has also been fixed by disabling external entity resolution in this case.
How To Fix
Minimum fixed version
3.0.6.RELEASE-6+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The XML External Entity (XXE) injection vulnerability in libspring-java can be exploited to conduct CSRF and DoS attacks on other sites. It has been fixed in version 3.0.6.RELEASE-6+deb7u1 and later. It is recommended to upgrade your libspring-java packages to the latest version to ensure the security of your applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libspring-java →
FAQ
This vulnerability allows an attacker to conduct CSRF and DoS attacks on other sites. It can potentially lead to unauthorized access, data leakage, and service disruption.
Versions of libspring-java prior to 3.0.6.RELEASE-6+deb7u1 on Debian 7 (wheezy) are affected.
Yes, the vulnerability has been fixed in libspring-java version 3.0.6.RELEASE-6+deb7u1 and later. It is recommended to upgrade to the latest version to mitigate the risk.
No specific workarounds have been mentioned for this vulnerability.
You can find more information about this vulnerability in the Debian Security Advisory DSA-2842-1.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
