Date: Wed, 19 Aug 2015 13:48:04 +0200 From: "Christofer Dutz" <cdutz@...che.org> To: security@...che.org, oss-security@...ts.openwall.com, bugtraq@...urityfocus.com, dev@...x.apache.org, users@...x.apache.org Subject: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Flex BlazeDS 4.7.0 Description: When receiving XML encoded AMF messages containing DTD entities, the default XML parser configurations allows expanding of entities to local resources. A request that included a specially crafted request parameter could be used to access content that would otherwise be protected. Mitigation: All users of Apache Flex BlazeDS prior to 4.7.1 Example: For an AMF message that contains the following xml payload: <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo> the entity &xxe; would be expanded to the content of the file /etc/passwd. However this expanded information is not automatically transferred back to the client, but could be made available by the application. Credit: This issue was discovered by Matthias Kaiser of Code White References: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing Christofer Dutz
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.