Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 19 Aug 2015 13:48:04 +0200
From: "Christofer Dutz" <cdutz@...che.org>
To: security@...che.org, oss-security@...ts.openwall.com,
 bugtraq@...urityfocus.com, dev@...x.apache.org, users@...x.apache.org
Subject: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion
 Vulnerability

CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion  
Vulnerability

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: Apache Flex BlazeDS 4.7.0

Description: When receiving XML encoded AMF messages containing DTD  
entities, the
default XML parser configurations allows expanding of entities to local  
resources.
A request that included a specially crafted request parameter could be  
used to
access content that would otherwise be protected.


Mitigation: All users of Apache Flex BlazeDS prior to 4.7.1

Example: For an AMF message that contains the following xml payload:
<?xml version="1.0" encoding="ISO-8859-1"?>
  <!DOCTYPE foo [
    <!ELEMENT foo ANY >
    <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>
the entity &xxe; would be expanded to the content of the file /etc/passwd.
However this expanded information is not automatically transferred back to
the client, but could be made available by the application.

Credit: This issue was discovered by ´╗┐Matthias Kaiser of Code White

References:  
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing

Christofer Dutz

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.