Signature Detail

HTTP: SpringSource Spring Framework XML External Entity Parsing Information Disclosure

This signature detects attempts to exploit a know vulnerability against SpringSource Spring Framework. The vulnerability is due to incorrectly configured XML parsing which accepts XML external entities from untrusted sources. A remote, unauthenticated attacker can leverage this vulnerability by sending a malicious request to the target server. Successful exploitation would result in the disclosure of information from arbitrary files available to the security context of the server application.

Extended Description

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.

Affected Products

• Springsource spring_framework 3.0.0
• Springsource spring_framework 3.0.0.m1
• Springsource spring_framework 3.0.0.m2
• Springsource spring_framework 3.0.1
• Springsource spring_framework 3.0.2
• Springsource spring_framework 3.0.3
• Springsource spring_framework 3.0.4
• Springsource spring_framework 3.0.5
• Springsource spring_framework 3.0.6
• Springsource spring_framework 3.0.7
• Springsource spring_framework 3.1.0
• Springsource spring_framework 3.1.1
• Springsource spring_framework 3.1.2
• Springsource spring_framework 3.1.3
• Springsource spring_framework 3.1.4
• Springsource spring_framework 3.2.0
• Springsource spring_framework 3.2.1
• Springsource spring_framework 3.2.2
• Springsource spring_framework 3.2.3
• Springsource spring_framework 4.0.0

References

• BugTraq: 61951
• CVE: CVE-2013-4152