[xfire-dev] [jira] (XFIRE-1156) XXE is set to accept external entities

[Ido Naor (JIRA)]

Title: Message Title

Ido Naor created an issue   XFire / XFIRE-1156 XXE is set to accept external entities Issue Type: Bug Affects Versions: 1.2.6, 1.2.7 Assignee: Dan Diephouse Attachments: ToXfire.png Components: JAX-WS, JAXB 2.0 Created: 18/Sep/14 2:46 AM Environment: Web Service Labels: exception Priority: Trivial Reporter: Ido Naor This vulnerability, commonly known as XXE (XML eXternal Entities) attacks could allow for an attacker's ability to use the XML parser to carry out attacks ranging from network port scanning, information disclosure, denial of service, and potentially to carry out remote file retrieval. The exception caught is: <faultstring>Illegal argument. For input string: "[Sensitive Data]"</faultstring>... xfire-1.2.6/xfire-core/src/main/org/codehaus/xfire/util/STAXUtils.java private static void configureFactory(XMLInputFactory xif, MessageContext ctx) { Boolean value = getBooleanProperty(ctx, XMLInputFactory.IS_VALIDATING); if (value != null) { xif.setProperty(XMLInputFactory.IS_VALIDATING, value); } value = getBooleanProperty(ctx, XMLInputFactory.IS_NAMESPACE_AWARE); if (value != null) { xif.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, value); } value = getBooleanProperty(ctx, XMLInputFactory.IS_COALESCING); if (value != null) { xif.setProperty(XMLInputFactory.IS_COALESCING, value); } value = getBooleanProperty(ctx, XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES); if (value != null) { xif.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, value); } value = getBooleanProperty(ctx, XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES); if (value != null) { xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, value); } } Seems like it is not set to False by default, leaving it vulnerable to the attack. Code should contain a strict API and code warning to prevent the malicious act. Add Comment   This message was sent by Atlassian JIRA (v6.1.6#6162-sha1:7af547c) --------------------------------------------------------------------- To unsubscribe from this list, please visit: http://xircles.codehaus.org/manage_email