Description

XML external entities were previously disabled with the publication of http://pivotal.io/security/cve-2013-6429. If DTD is not entirely disabled, inline DTD declarations can be used to perform Denial of Service attacks known as XML bombs. Such declarations are both well-formed and valid according to XML schema rules but when parsed can cause out of memory errors. To protect against this kind of attack DTD support must be disabled by setting the disallow-doctype-dec feature in the DOM and SAX APIs to true and by setting the supportDTD property in the StAX API to false.

This is now done in the Spring Framework by default wherever the framework sets up XML parsing from external sources. Mainly this includes the Unmarshaller implementations in spring-oxm and the HttpMessageConverter implementations in spring-web.

Note that further actions may need to be taken by applications in particular where use of StAX is concerned. For example IBM JDK 1.6 and 1.7 require an environment variable in addition to setting supportDTD=false (see IBM JDK reference). Moreover we’ve found that supportDTD alone does not protect against all kinds of DoS attacks with JDK JAXP implementations. Hence we recommend using the Woodstox open source library for StAX parsing.

The following describes when StAX is used in the Spring Framework:

• SourceHttpMessageConverter -- enabled by default. The converter was added in 3.2 while StAX support was added in 4.0.1 and is used when converting to Spring MVC controller method argument of type javax.xml.transform.stax.StAXSource.
• Jaxb2CollectionHttpMessageConverter -- not enabled by default. This converter was added in 3.2.
• MappingJackson2XmlHttpMessageConverter -- enabled when “jackson-dataformat-xml” is present on the classpath. This converter was added in 4.1.

Affected Spring Products and Versions

• Spring Framework 3.2.0 to 3.2.13
• Spring Framework 4.0.0 to 4.1.6
• Other unsupported versions are also affected

Mitigation

Users of affected Spring Framework versions should upgrade as follows:

• For 3.2.x upgrade to <strong>3.2.14+</strong>
• For 4.0.x and 4.1.x upgrade to <strong>4.1.7+</strong>

In addition, applications that consume XML input via StAX from external sources should also use and/or upgrade to a recent version of the Woodstox library, e.g. version 4.2+ (4.2.1 is the currently curated version in the Spring IO Platform).

Notes on adding Woodstox:

StAX defines a standard mechanism for selecting which StAX implementation to use when more than one is available including system properties and service definitions under WEB-INF/services. Woodstox includes the necessary service definitions so that simply adding it to the classpath should work. However some application servers such as WebLogic already bundle (an older version) of Woodstox in which case you may need to configure the server to prefer the one chosen by the application, see this reference on prefer-application-packages.

Credit

This issue was identified responsibly and reported to Pivotal by Toshiaki Maki of NTT DATA Corporation who also helped to develop and test the solution.

References

• https://jira.spring.io/browse/SPR-13136
…

Description

Session id generation in the Java SockJS client is not sufficiently secure and could allow a user to send messages to another user’s session.

Note that this only affects users of the Java SockJS client, which generates its own session id. It does not affect browser clients even if they’re connecting to the same server.

Furthermore, since SockJS is a transport layer, when using a higher level messaging protocol on top such as STOMP over WebSocket with the spring-messaging module, application-level security may already be getting applied to STOMP messages and that can neutralize the impact of any potential attacks.

Affected Spring Products and Versions

• Spring Framework 4.1.0 to 4.1.4

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 4.1.x should upgrade to 4.1.5 or later

Credit

Philippe Arteau found and responsibly reported the problem to Pivotal.

References

• https://github.com/spring-projects/spring-framework/commit/dc5b5ca8ee09c890352f89b2dae58bc0132d6545
• https://github.com/spring-projects/spring-framework/commit/d63cfc8eebc396be009e733a81ebb4c984811f6e
…

Description

Some URLs were not santized correctly before use allowing an attacker to obtain any file on the file system that was also accessible to process in which the Spring web application was running.

Affected Spring Products and Versions

• Spring Framework 3.0.4 to 3.2.11
• Spring Framework 4.0.0 to 4.0.7
• Spring Framework 4.1.0 to 4.1.1
• Other unsupported versions may also be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.2.x should upgrade to 3.2.12 or later
• Users of 4.0.x should upgrade to 4.0.8 or later
• Users of 4.1.x should upgrade to 4.1.2 or later

Credit

This issue was identified by Toshiaki Maki of NTT DATA Corporation and responsibly reported to Pivotal.

References

• https://jira.spring.io/browse/SPR-12354
• https://github.com/spring-projects/spring-framework/commit/9beae9ae4226c45cd428035dae81214439324676
• https://github.com/spring-projects/spring-framework/commit/9cef8e3001ddd61c734281a7556efd84b6cc2755
• …

Description

Some URLs were not sanitized correctly before use allowing an attacker to obtain any file on the file system that was also accessible to process in which the Spring web application was running.

Affected Spring Products and Versions

• 4.0.0 to 4.0.4
• 3.2.0 to 3.2.8
• 3.1.1 is known to be affected
• Other unsupported versions may also be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.9 or later
• Users of 4.x should upgrade to 4.0.5 or later

Credit

This issue was identified by Takeshi Terada of Mitsui Bussan Secure Directions, Inc. and reported to Pivotal via JPCERT/CC. Information that additional versions were affected was discovered…

Description

When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request.

This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed.

If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.

Affected Spring Products and Versions

• 3.1 to 3.2.4

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.2x should upgrade to 3.2.5 or later
• Users of 3.1.x should upgrade to 3.1.7 or later

Credit

This issue was identified by David Ohsie and brought to our attention by the CAS Development team.

References

• http://spring.io/blog/2014/08/15/cve-2014-3527-fixed-in-spring-security-3-2-5-and-3-1-7
• https://jira.spring.io/browse/SEC-2688
…

Description

When processing user provided XML documents, the Spring Framework did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

Affected Spring Products and Versions

• Spring MVC 3.0.0 to 3.2.8
• Spring MVC 4.0.0 to 4.0.4
• Earlier unsupported versions may be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.9 or later
• Users of 4.x should upgrade to 4.0.5 or later

Credit

This issue was discovered and reported responsibly to the Pivotal security team by Nebula(XIAOBAISHAN,CHIBI,HUBEI.CN) HelloWorld security team, DBappsecurity.com security team. Additional…

Description

Spring MVC's Jaxb2RootElementHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. Jaxb2RootElementHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default.

Affected Spring Products and Versions

• Spring MVC 3.0.0 to 3.2.7
• Spring MVC 4.0.0 to 4.0.1
• Earlier unsupported versions may be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.8 or later
• Users of 4.x should upgrade to 4.0.2 or later

Credit

This issue was reported to the Spring Framework developers by Spase Markovski.

References

• https://jira.springsource.org/browse/SPR-11376
• https://github.com/spring-projects/spring-framework/commit/edba32b3093703d5e9ed42b5b8ec23ecc1998398#diff-1f3f1d5cdab9ac92d1ca5ec7def8f131
• https://github.com/spring-projects/spring…

Description

The ActiveDirectoryLdapAuthenticator does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

Affected Spring Products and Versions

• Spring Security 3.2.0 to 3.2.1
• Spring Security 3.1.0 to 3.1.5

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.2.x should upgrade to 3.2.2 or later
• Users of 3.1.x should upgrade to 3.1.6 or later

Credit

This issue was identified by the Spring Development team.

References

• https://jira.springsource.org/browse/SEC-2500
• https://github.com/spring-projects/spring-security/commit/88559882e967085c47a7e1dcbc4dc32c2c796868
• https://github.com/spring-projects/spring-security/commit/7dbb8e777ece8675f3333a1ef1cb4d6b9be80395
• …

Description

When a programmer does not specify the action on the Spring form, Spring automatically populates the action field with the requested uri. An attacker can use this to inject malicious content into the form.

Affected Spring Products and Versions

• Spring MVC 3.0.0 to 3.2.7
• Spring MVC 4.0.0 to 4.0.1
• Earlier unsupported versions may be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.8 or later
• Users of 4.x should upgrade to 4.0.2 or later

Credit

This issue was discovered and reported responsibly to the Pivotal security team by Paul Wowk of CAaNES LLC.

References

• https://jira.springsource.org/browse/SPR-11426
• https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485
• https://github.com/spring-projects/spring-framework/commit…

Description

Spring MVC's SourceHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. SourceHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default. It was subsequently discovered that this fix was also incomplete (CVE-2014-0054).

Affected Spring Products and Versions

• Spring MVC 3.0.0 to 3.2.4
• Spring MVC 4.0.0.M1-4.0.0.RC1
• Earlier unsupported versions may be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.5 or later
• Users of 4.x should upgrade to 4.0.0 or later (This is also fixed in 4.0.0-RC2 but users are recommended to use 4.0.0 or later)
• To fully mitigate this issue (including CVE-2014-0054), users of 3.x should upgrade to 3.2.8 or later and users of 4.x should upgrade to 4.0.2 or later.

Credit

This issue was identified by the Spring development team.

References

• https://jira.springsource.org/browse/SPR-11078

History

2014-Jan-15: Initial vulnerability report.

• 2014-Jun-19: Update to reflect split of CVE-2013-4152 into CVE-2013-4152 and CVE-2013-7315. Added information on additional vulnerability report that identified that this fix was incomplete.
…