[SECURITY] CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags
Jeremy Boynes <[email protected]> Thu, 26 Feb 2015 22:16:33 -0800
| Newsgroups | gmane.comp.jakarta.taglibs.user,gmane.comp.apache.maven.announce,gmane.comp.security.full-disclosure,gmane.comp.jakarta.tomcat.user,gmane.comp.apache.incubator.bigtop.devel,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <82207A16-6348-4DEE-877E-F7B87292576A__32629.3213562623$1425038956$gmane$org@apache.org> |
--Apple-Mail=_64B299DD-5EB8-4699-99EC-5E000ED6E373 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags Severity: Important Vendor: The Apache Software Foundation Versions Affected: Standard Taglibs 1.2.1 The unsupported 1.0.x and 1.1.x versions may also be affected. Description: When an application uses <x:parse> or <x:transform> tags to process = untrusted XML documents, a request may utilize external entity = references to access resources on the host system or utilize XSLT = extensions that may allow remote execution. Mitigation: Users should upgrade to Apache Standard Taglibs 1.2.3 or later. This version uses JAXP=E2=80=99s FEATURE_SECURE_PROCESSING to restrict = XML processing. Depending on the Java runtime version in use, additional = configuration may be required: Java8: External entity access is automatically disabled if a = SecurityManager is active. Java7: JAXP properties may need to be used to disable external access. = See = http://docs.oracle.com/javase/tutorial/jaxp/properties/properties.html Java6 and earlier: A new system property = org.apache.taglibs.standard.xml.accessExternalEntity may be used to = specify the protocols that can be used to access external entities. This = defaults to =E2=80=9Call=E2=80=9D if no SecurityManager is present and = to =E2=80=9C=E2=80=9D (thereby disabling access) if a SecurityManager is = detected. Credit: David Jorm of IIX --Apple-Mail=_64B299DD-5EB8-4699-99EC-5E000ED6E373 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJU8AvBAAoJEKVK0I6noCM8P0wIAMz5sZkpzoe7r7ryIdZ+XRLp eq7gBjT6yMwbE5yQ4rGUioMPpY4deA8rK+z68ci4anVCdbEcZJFRKAEX2EQV7KUk Y8O0TRbdCXHEVvgSQpOJyrVkAS1gxbUs/0dho9zlIM7Vyn9b712nxrmYTRt+nKeE A/2+Xc+2Wa3SZObcaww5g4J3p6SnCACs77ZQLvq6L6FIMlg2Cry9qHofD72ouMhu jTf40QLxe0PRYxHUZV9HSJmr56p/gTM7k/GKielgwRpp0HJnq2OyDB7CG0Xmk4kV EFx1C6XcEnm9OFtG2A9RdFOcSSPYex/vrTWehFKtV6B4ptq1EyUlwrzA+GL2mJk= =79ZY -----END PGP SIGNATURE----- --Apple-Mail=_64B299DD-5EB8-4699-99EC-5E000ED6E373--