[CVE-2020-11991] Apache Cocoon security vulnerability
Cédric Damioli <[email protected]> Fri, 11 Sep 2020 11:39:23 +0200
| Newsgroups | gmane.text.xml.cocoon.user |
|---|---|
| Organization | Apache Software Foundation |
| Message-ID | <bdc77163-a100-004c-7441-e0062a2161e7__17021.6506741539$1599817183$gmane$org@apache.org> |
--------------0FAE5F53FE0A8DE23D1143BF
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
[CVE-2020-11991] Apache Cocoon security vulnerability
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected: Apache Cocoon up to 2.1.12
Description: When using the StreamGenerator, the code parse a
user-provided XML.
A specially crafted XML, including external system entities, could be
used to access any file on the server system.
Mitigation:
The StreamGenerator now ignores external entities. 2.1.x users should
upgrade to 2.1.13
Example:
With the following input :
<!--?xml version="1.0" ?--> <!DOCTYPE replace [<!ENTITY ent SYSTEM
"file:///etc/shadow"> ]> <userInfo> <firstName>John</firstName>
<lastName>&ent;</lastName> </userInfo> an attacker got the content of
/etc/shadow
Credit: This issue was discovered by Nassim Asrir.
Regards,
--
Cédric Damioli
--------------0FAE5F53FE0A8DE23D1143BF
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">[CVE-2020-11991] Apache Cocoon security vulnerability
</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">Severity: Important
</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">Vendor:
The Apache Software Foundation
</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">Versions Affected:
Apache Cocoon up to 2.1.12
</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">Description:
When using the StreamGenerator, the code parse a user-provided XML.</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">A specially crafted XML, including external system entities, could be used to access any file on the server system.
</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">
</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">Mitigation:</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">The StreamGenerator now ignores external entities.
2.1.x users should upgrade to 2.1.13
</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">Example:</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">With the following input :</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;"><!--?xml version="1.0" ?-->
<!DOCTYPE replace [<!ENTITY ent SYSTEM <a class="moz-txt-link-rfc2396E">"file:///etc/shadow"</a>> ]>
<userInfo>
<firstName>John</firstName>
<lastName>&ent;</lastName>
</userInfo>
an attacker got the content of /etc/shadow
</p>
<p style="padding: 0px; margin: 0px; color: rgb(0, 0, 0); font-family: Arial, Helvetica, "Luxi Sans", sans-serif; font-size: 14.4px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;">Credit:
This issue was discovered by Nassim Asrir.</p>
<br>
Regards,<br>
<pre class="moz-signature" cols="72">--
Cédric Damioli
</pre>
</body>
</html>
--------------0FAE5F53FE0A8DE23D1143BF--