CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability

classic Classic list List threaded Threaded
6 messages Options
Reply | Threaded
Open this post in threaded view
|

CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability

Christofer Dutz-2
CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion  
Vulnerability

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: Apache Flex BlazeDS 4.7.0

Description: When receiving XML encoded AMF messages containing DTD  
entities, the
default XML parser configurations allows expanding of entities to local  
resources.
A request that included a specially crafted request parameter could be  
used to
access content that would otherwise be protected.


Mitigation: All users of Apache Flex BlazeDS prior to 4.7.1

Example: For an AMF message that contains the following xml payload:
<?xml version="1.0" encoding="ISO-8859-1"?>
  <!DOCTYPE foo [
    <!ELEMENT foo ANY >
    <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>
the entity &xxe; would be expanded to the content of the file /etc/passwd.
However this expanded information is not automatically transferred back to
the client, but could be made available by the application.

Credit: This issue was discovered by ´╗┐Matthias Kaiser of Code White

References:  
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing

Christofer Dutz
Reply | Threaded
Open this post in threaded view
|

Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability

Andrew Kerr
Does anyone know if this affects the older Adobe BlazeDS 4.6.0?

Thanks,
Andrew


On Wed, Aug 19, 2015 at 7:48 AM, Christofer Dutz <[hidden email]> wrote:

> CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion
> Vulnerability
>
> Severity: Important
>
> Vendor: The Apache Software Foundation
>
> Versions Affected: Apache Flex BlazeDS 4.7.0
>
> Description: When receiving XML encoded AMF messages containing DTD
> entities, the
> default XML parser configurations allows expanding of entities to local
> resources.
> A request that included a specially crafted request parameter could be
> used to
> access content that would otherwise be protected.
>
>
> Mitigation: All users of Apache Flex BlazeDS prior to 4.7.1
>
> Example: For an AMF message that contains the following xml payload:
> <?xml version="1.0" encoding="ISO-8859-1"?>
>  <!DOCTYPE foo [
>    <!ELEMENT foo ANY >
>    <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>
> the entity &xxe; would be expanded to the content of the file /etc/passwd.
> However this expanded information is not automatically transferred back to
> the client, but could be made available by the application.
>
> Credit: This issue was discovered by ´╗┐Matthias Kaiser of Code White
>
> References:
> https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
>
> Christofer Dutz
>



--
Andrew Kerr
Reply | Threaded
Open this post in threaded view
|

Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability

Tom Chiverton
On 19/08/15 13:07, Andrew Kerr wrote:
> Does anyone know if this affects the older Adobe BlazeDS 4.6.0?

You'd need to check with Adobe.

They published an advisor today on the topic :
http://blogs.adobe.com/psirt/?p=1259
but it only mentions LiveCycle DS.

Tom
Reply | Threaded
Open this post in threaded view
|

AW: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability

Christofer Dutz
Hi Andrew,

Well as 4.7.0 was the parity-release to 4.6.0 and we didn't really change any functionality since the donation prior to 4.7.0, I would bet on it. To me it looked as if this issue must have been sitting there since the dawn of time. But we explicitly didn't want to mention Adobe BlazeDS in our announcement.

Chris

________________________________________
Von: Tom Chiverton <[hidden email]>
Gesendet: Mittwoch, 19. August 2015 14:13
An: [hidden email]
Betreff: Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability

On 19/08/15 13:07, Andrew Kerr wrote:
> Does anyone know if this affects the older Adobe BlazeDS 4.6.0?

You'd need to check with Adobe.

They published an advisor today on the topic :
http://blogs.adobe.com/psirt/?p=1259
but it only mentions LiveCycle DS.

Tom
Reply | Threaded
Open this post in threaded view
|

Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability

Andrew Kerr
Thanks, that's what I thought. We will make the move to upgrade to 4.7.1
from 4.6.

On Wed, Aug 19, 2015 at 8:27 AM, Christofer Dutz <[hidden email]>
wrote:

> Hi Andrew,
>
> Well as 4.7.0 was the parity-release to 4.6.0 and we didn't really change
> any functionality since the donation prior to 4.7.0, I would bet on it. To
> me it looked as if this issue must have been sitting there since the dawn
> of time. But we explicitly didn't want to mention Adobe BlazeDS in our
> announcement.
>
> Chris
>
> ________________________________________
> Von: Tom Chiverton <[hidden email]>
> Gesendet: Mittwoch, 19. August 2015 14:13
> An: [hidden email]
> Betreff: Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity
> Expansion Vulnerability
>
> On 19/08/15 13:07, Andrew Kerr wrote:
> > Does anyone know if this affects the older Adobe BlazeDS 4.6.0?
>
> You'd need to check with Adobe.
>
> They published an advisor today on the topic :
> http://blogs.adobe.com/psirt/?p=1259
> but it only mentions LiveCycle DS.
>
> Tom
>



--
Andrew Kerr
Reply | Threaded
Open this post in threaded view
|

Re: CVE-2015-3269 Apache Flex BlazeDS Insecure Xml Entity Expansion Vulnerability

Alex Harui
In reply to this post by Tom Chiverton
For questions about Adobe releases, email [hidden email].

-Alex

On 8/19/15, 5:13 AM, "Tom Chiverton" <[hidden email]> wrote:

>On 19/08/15 13:07, Andrew Kerr wrote:
>> Does anyone know if this affects the older Adobe BlazeDS 4.6.0?
>
>You'd need to check with Adobe.
>
>They published an advisor today on the topic :
>http://blogs.adobe.com/psirt/?p=1259
>but it only mentions LiveCycle DS.
>
>Tom