Re: [CVE-2020-11991] Apache Cocoon security vulnerability
Cédric Damioli <[email protected]> Fri, 11 Sep 2020 21:46:23 +0200
| Newsgroups | gmane.text.xml.cocoon.user |
|---|---|
| Organization | Apache Software Foundation |
| Message-ID | <[email protected]> |
--------------E1339A42756579DA8E411A00 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Hi, Entities resolution is managed by features of the SAX Parser, before any transformation. Cédric Le 11/09/2020 à 12:12, gelo1234 a écrit : > > Hello Cedric, > > Are external entities blocked also in XSLT? > > Greetings, > Greg > > pt., 11 wrz 2020 o 11:39 Cédric Damioli <[email protected] > <mailto:[email protected]>> napisał(a): > > [CVE-2020-11991] Apache Cocoon security vulnerability > > Severity: Important > > Vendor: The Apache Software Foundation > > Versions Affected: Apache Cocoon up to 2.1.12 > > Description: When using the StreamGenerator, the code parse a > user-provided XML. > > A specially crafted XML, including external system entities, could > be used to access any file on the server system. > > Mitigation: > > The StreamGenerator now ignores external entities. 2.1.x users > should upgrade to 2.1.13 > > Example: > > With the following input : > > <!--?xml version="1.0" ?--> <!DOCTYPE replace [<!ENTITY ent SYSTEM > "file:///etc/shadow"> ]> <userInfo> <firstName>John</firstName> > <lastName>&ent;</lastName> </userInfo> an attacker got the content > of /etc/shadow > > Credit: This issue was discovered by Nassim Asrir. > > > Regards, > > -- > Cédric Damioli > -- Cédric Damioli CMS - Java - Open Source www.ametys.org --------------E1339A42756579DA8E411A00 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> Hi,<br> <br> Entities resolution is managed by features of the SAX Parser, before any transformation.<br> <br> Cédric<br> <br> <div class="moz-cite-prefix">Le 11/09/2020 à 12:12, gelo1234 a écrit :<br> </div> <blockquote type="cite" cite="mid:CAPJaKUp78rRrew7L=74cgctavWOT3dWX8kkF4Qhd4=Mmz90dfw@mail.gmail.com"> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <div dir="ltr"> <div class="gmail_default" style="font-size:small"><br> </div> <div class="gmail_default" style="font-size:small">Hello Cedric,</div> <div class="gmail_default" style="font-size:small"><br> </div> <div class="gmail_default" style="font-size:small">Are external entities blocked also in XSLT? <br> </div> <div class="gmail_default" style="font-size:small"><br> </div> <div class="gmail_default" style="font-size:small">Greetings,</div> <div class="gmail_default" style="font-size:small">Greg<br> </div> </div> <br> <div class="gmail_quote"> <div dir="ltr" class="gmail_attr">pt., 11 wrz 2020 o 11:39 Cédric Damioli <<a href="mailto:[email protected]" moz-do-not-send="true">[email protected]</a>> napisał(a):<br> </div> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">[CVE-2020-11991] Apache Cocoon security vulnerability </p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Severity: Important </p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Vendor: The Apache Software Foundation </p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Versions Affected: Apache Cocoon up to 2.1.12 </p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Description: When using the StreamGenerator, the code parse a user-provided XML.</p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">A specially crafted XML, including external system entities, could be used to access any file on the server system. </p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"> </p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Mitigation:</p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">The StreamGenerator now ignores external entities. 2.1.x users should upgrade to 2.1.13 </p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Example:</p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">With the following input :</p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><!--?xml version="1.0" ?--> <!DOCTYPE replace [<!ENTITY ent SYSTEM <a moz-do-not-send="true">"file:///etc/shadow"</a>> ]> <userInfo> <firstName>John</firstName> <lastName>&ent;</lastName> </userInfo> an attacker got the content of /etc/shadow </p> <p style="padding:0px;margin:0px;color:rgb(0,0,0);font-family:Arial,Helvetica,"Luxi Sans",sans-serif;font-size:14.4px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">Credit: This issue was discovered by Nassim Asrir.</p> <br> Regards,<br> <pre cols="72">-- Cédric Damioli </pre> </div> </blockquote> </div> </blockquote> <br> <pre class="moz-signature" cols="72">-- Cédric Damioli CMS - Java - Open Source <a class="moz-txt-link-abbreviated" href="http://www.ametys.org">www.ametys.org</a></pre> </body> </html> --------------E1339A42756579DA8E411A00--