Critical XXE Vulnerability in libspring-java Package: CVE-2014-0225
Summary
UBUNTU-CVE-2014-0225: When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration... Affects libspring-java versions < 3.0.6.RELEASE-13ubuntu0.1~esm1. Fixed in 3.0.6.RELEASE-13ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The libspring-java package is a core component of the Spring Framework, which is widely used for building enterprise-level applications in Java. It provides comprehensive infrastructure support for developing Java applications, including features for dependency injection, aspect-oriented programming, and transaction management. However, certain versions of this package are vulnerable to an XML External Entity (XXE) attack, which can lead to severe security breaches.
Vulnerability Detail
The vulnerability arises from the Spring Framework versions 4.0.0 to 4.0.4 and 3.0.0 to 3.2.8, which do not disable the resolution of URI references in DTD declarations by default when processing user-provided XML documents. This oversight allows attackers to exploit the application by crafting malicious XML input that can lead to unauthorized access to sensitive data, server-side request forgery (SSRF), and other security risks. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
3.0.6.RELEASE-13ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable DTD processing in your XML parser configuration. This can be done by setting the following property in your XML parsing code:
System.setProperty('javax.xml.XMLConstants/property/accessExternalDTD', 'all');
However, this is not a permanent fix and should be followed by an update to the patched version.
Conclusion
The CVE-2014-0225 vulnerability in the libspring-java package poses significant security risks due to its potential for XXE attacks. It is crucial to update to the patched version to mitigate these risks. Users should also consider implementing temporary workarounds while preparing for the update.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2014-0225 is a vulnerability in the Spring Framework that allows for XML External Entity (XXE) attacks due to improper handling of DTD declarations.
The affected versions include Spring Framework 4.0.0 to 4.0.4 and 3.0.0 to 3.2.8.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, server-side request forgery, and other security breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, implement the provided workaround to disable DTD processing in your XML parser until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
