XXE vulnerability

[guykoth]

DTD processing was enabled and therefore, XML deserialization process was vulnerable to XML External Entity Injection (I was able to expose local files).
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing

Suggestion is to ignore client-side DOCTYPE declarations.

[joehni]

XStream supports a big number of XML parsers. Its default is Xpp3 which does not support entities at all. So what parser did you use?

[joehni]

XStream supports a big number of XML parsers. Its default is Xpp3 which does not support entities at all. So what parser did you use?

[guykoth]

Payload:

%passwd;
]>

[guykoth]

Payload:

%passwd;
]>

[joehni]

As far as possible I've turned off processing of external entities for all affected parsers.

[joehni]

As far as possible I've turned off processing of external entities for all affected parsers.

[joehni]

Ported into 1.4.x branch.

[joehni]

Ported into 1.4.x branch.

[govindraghu]

I am using xstream-1.3.1 version. Is the "turn off on external entities" implemented in this version?

[govindraghu]

I am using xstream-1.3.1 version. Is the "turn off on external entities" implemented in this version?

[joehni]

No. That version is 7 years old and the 1.3.x line is no longer maintained.

[joehni]

No. That version is 7 years old and the 1.3.x line is no longer maintained.

[govindraghu]

Thanks joehni for your quick response. I will plan on upgrading the to the latest version. In the mean time, I downloaded the latest source code of 1.4.8. Can you point me what class/method addresses the fix "disallow-doctype-decl" as pointed out in URL https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing

String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
dbf.setFeature(FEATURE, true);

[govindraghu]

Thanks joehni for your quick response. I will plan on upgrading the to the latest version. In the mean time, I downloaded the latest source code of 1.4.8. Can you point me what class/method addresses the fix "disallow-doctype-decl" as pointed out in URL https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing

String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
dbf.setFeature(FEATURE, true);

[joehni]

Hi, it's unfortunately not yet released. It's a series of commits. Look into the history of the 1.4.x branch in October 2015.

[joehni]

Hi, it's unfortunately not yet released. It's a series of commits. Look into the history of the 1.4.x branch in October 2015.

[mceli]

Hello @joehni , Is xstream-1.4.3 vulnerable to this issue?

[mceli]

Hello @joehni , Is xstream-1.4.3 vulnerable to this issue?

[joehni]

Look at the milestone of this issue.

[joehni]

Look at the milestone of this issue.

[adioss]

Hello,

A little question/remark: the threat is reported here: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3674. You can notice that:

cpe:/a:x-stream:xstream:1.4.8 and previous versions

so the product vendor here is "x-stream". But now (I can see it here http://mvnrepository.com/artifact/xstream/xstream) the vendor for current version is "com.thoughtworks.xstream" so in my opinion, CVE is not correctly reported for the moment. For example, if you use tools like OWASP dependency check (or maybe blackduck), you won't be able to detect that the lib is sensitive to potential threat.

Do you think it's possible to contact NIST to update/add the new vendor to CPE (very sorry, I'm NOT (sorry) aware how to do that/if it's possible...)?

Adrien

[adioss]

Hello,

A little question/remark: the threat is reported here: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3674. You can notice that:

cpe:/a:x-stream:xstream:1.4.8 and previous versions

so the product vendor here is "x-stream". But now (I can see it here http://mvnrepository.com/artifact/xstream/xstream) the vendor for current version is "com.thoughtworks.xstream" so in my opinion, CVE is not correctly reported for the moment. For example, if you use tools like OWASP dependency check (or maybe blackduck), you won't be able to detect that the lib is sensitive to potential threat.

Do you think it's possible to contact NIST to update/add the new vendor to CPE (very sorry, I'm NOT (sorry) aware how to do that/if it's possible...)?

Adrien

[joehni]

Hi,
actually I have no clue, how this report has been generated. All I did was to send an CVE request to Openwall and got the number back after some time.

[joehni]

Hi,
actually I have no clue, how this report has been generated. All I did was to send an CVE request to Openwall and got the number back after some time.