lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <005e01ced7d4$934b0950$9b7a6fd5@pc>
Date: Sat, 2 Nov 2013 16:04:59 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: XXE Injection in Spring Framework

Hello!

I'll give you additional information concerning advisory XML External Entity 
(XXE) Injection in Spring Framework 
(http://securityvulns.ru/docs29758.html).

-------------------------
Affected products:
-------------------------

- 3.0.0 to 3.2.3 (Spring OXM & Spring MVC)
- 4.0.0.M1 (Spring OXM)
- 4.0.0.M1-4.0.0.M2 (Spring MVC)
- Earlier unsupported versions may also be affected

-------------------------
Affected vendors:
-------------------------

Spring by Pivotal.

----------
Details:
----------

The Spring OXM wrapper doesn't disable external entity resolution when using 
the JAXB unmarshaller (SAXSource and StreamSource instances are vulnerable). 
Also Spring MVC processes user provided XML with JAXB in combination with a 
StAX XMLInputFactory without disabling external entity resolution.

Besides standard vectors of attacks with XXE Injection vulnerabilities (such 
as local file inclusion), which are usually mentioned in advisories, XXE 
Injection also allows to conduct attacks on other sites. And with using 
DAVOSET (DDoS attacks via other sites execution tool) it's possible to 
automate such attacks.

I wrote about such attacks in my 2012's article "Using XML External Entities 
(XXE) for attacks on other sites" 
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2012-August/008481.html) 
and 2013's "Using XXE vulnerabilities for attacks on other sites" 
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2013-August/008887.html).
As I described in my articles, XXE vulnerabilities can be used for 
conducting CSRF and DoS attacks on other sites (and at using multiple web
sites it's possible to conduct DDoS attacks). And my tool DAVOSET can be 
used for conducting such attacks via XXE vulnerabilities.

In October I released video demonstration of DAVOSET: 
http://www.youtube.com/watch?v=RKi35-f346I

So all vulnerable web applications with affected versions of Spring 
Framework can be used for attacks on other sites via XXE Injection.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ