Re: [CVE-2020-11991] Apache Cocoon security vulnerability

--00000000000025ea4805af06eb5e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello Cedric,

Are external entities blocked also in XSLT?

Greetings,
Greg

pt., 11 wrz 2020 o 11:39 C=C3=A9dric Damioli <[email protected]> napisa=
=C5=82(a):

> [CVE-2020-11991] Apache Cocoon security vulnerability
>
> Severity: Important
>
> Vendor: The Apache Software Foundation
>
> Versions Affected: Apache Cocoon up to 2.1.12
>
> Description: When using the StreamGenerator, the code parse a
> user-provided XML.
>
> A specially crafted XML, including external system entities, could be use=
d
> to access any file on the server system.
>
> Mitigation:
>
> The StreamGenerator now ignores external entities. 2.1.x users should
> upgrade to 2.1.13
>
> Example:
>
> With the following input :
>
> <!--?xml version=3D"1.0" ?--> <!DOCTYPE replace [<!ENTITY ent SYSTEM
> "file:///etc/shadow"> ]> <userInfo> <firstName>John</firstName>
> <lastName>&ent;</lastName> </userInfo> an attacker got the content of
> /etc/shadow
>
> Credit: This issue was discovered by =EF=BB=BFNassim Asrir.
>
> Regards,
>
> --
> C=C3=A9dric Damioli
>
>

--00000000000025ea4805af06eb5e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-size:small"><br=
></div><div class=3D"gmail_default" style=3D"font-size:small">Hello Cedric,=
</div><div class=3D"gmail_default" style=3D"font-size:small"><br></div><div=
 class=3D"gmail_default" style=3D"font-size:small">Are external entities bl=
ocked also in XSLT? <br></div><div class=3D"gmail_default" style=3D"font-si=
ze:small"><br></div><div class=3D"gmail_default" style=3D"font-size:small">=
Greetings,</div><div class=3D"gmail_default" style=3D"font-size:small">Greg=
<br></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gm=
ail_attr">pt., 11 wrz 2020 o 11:39=C2=A0C=C3=A9dric Damioli &lt;<a href=3D"=
mailto:[email protected]">[email protected]</a>&gt; napisa=C5=82(a):<br=
></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;=
border-left:1px solid rgb(204,204,204);padding-left:1ex">
 =20
   =20
 =20
  <div>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">[CVE-2020-11991] Ap=
ache Cocoon security vulnerability

</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">Severity: Important

</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">Vendor:
The Apache Software Foundation

</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">Versions Affected:
Apache Cocoon up to 2.1.12


</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">Description:
When using the StreamGenerator, the code parse a user-provided XML.</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">A specially crafted=
 XML, including external system entities, could be used to access any file =
on the server system.=20
</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">

</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">Mitigation:</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">The StreamGenerator=
 now ignores external entities.
2.1.x users should upgrade to 2.1.13

</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">Example:</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">With the following =
input :</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">&lt;!--?xml version=
=3D&quot;1.0&quot; ?--&gt;
&lt;!DOCTYPE replace [&lt;!ENTITY ent SYSTEM <a>&quot;file:///etc/shadow&qu=
ot;</a>&gt; ]&gt;
&lt;userInfo&gt;
    &lt;firstName&gt;John&lt;/firstName&gt;
    &lt;lastName&gt;&amp;ent;&lt;/lastName&gt;
&lt;/userInfo&gt;

an attacker got the content of /etc/shadow


</p>
    <p style=3D"padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,H=
elvetica,&quot;Luxi Sans&quot;,sans-serif;font-size:14.4px;font-style:norma=
l;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-=
decoration-style:initial;text-decoration-color:initial">Credit:
This issue was discovered by =EF=BB=BFNassim Asrir.</p>
    <br>
    Regards,<br>
    <pre cols=3D"72">--=20
C=C3=A9dric Damioli
</pre>
  </div>

</blockquote></div>

--00000000000025ea4805af06eb5e--