CVE-2013-4152: CSRF
It was reported [1] that the Spring Framework suffered from several XML External Entity (XXE) flaws:
Versions Affected: - 3.0.0 to 3.2.3 (Spring OXM) - 3.2.0 to 3.2.3 (Spring MVC) - 4.0.0.M1 (Spring OXM) - 4.0.0.M1-4.0.0.M2 (Spring MVC) - Earlier unsupported versions may also be affected
Description: The Spring OXM wrapper did not expose any property for disabling entity resolution when using the JAXB unmarshaller. There are four possible source implementations passed to the unmarshaller: - DOMSource - StAXSource - SAXSource - StreamSource For a DOMSource, the XML has already been parsed by user code and that code is responsible for protecting against XXE. For a StAXSource, the XMLStreamReader has already been created by user code and that code is responsible for protecting against XXE. For SAXSource and StreamSource instances, Spring processed external entities by default thereby creating this vulnerability. The issue was resolved by disabling external entity processing by default and adding an option to enable it for those users that need to use this feature when processing XML from a trusted source.
It was also identified that Spring MVC processed user provided XML with JAXB in combination with a StAX XMLInputFactory without disabling external entity resolution. External entity resolution has been disabled in this case.
Mitigation: Users of affected versions should apply the following mitigation: - Users of 3.x should upgrade to 3.2.4 or later - Users of 4.x should upgrade to 4.0.0.RC1 or later once released Note the Spring OXM issue is fixed in 4.0.0.M2
[1] http://seclists.org/bugtraq/2013/Aug/154
External References:
http://www.gopivotal.com/security/cve-2013-4152 https://github.com/SpringSource/spring-framework/pull/317 https://jira.springsource.org/browse/SPR-10806
Other sources
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/activemqto a version that resolves this vulnerability.Fixed in 0:5.9.0-4.redhat.610328.el6 - Upgrade
Upgrade
redhat/Spring Frameworkto a version that resolves this vulnerability.Fixed in 3.2.4 - Upgrade
Upgrade
maven/org.springframework:spring-oxmto a version that resolves this vulnerability.Fixed in 3.2.4.RELEASE - Upgrade
Upgrade
Spring OXMto a version that resolves this vulnerability.Fixed in 3.2.4 - Upgrade
Upgrade
Spring MVCto a version that resolves this vulnerability.Fixed in 3.2.4 - Upgrade
Upgrade
Spring OXMto a version that resolves this vulnerability.Fixed in 4.0.0.M2 - Upgrade
Upgrade
Spring MVCto a version that resolves this vulnerability.Fixed in 4.0.0.RC1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2013-4152?
CVE-2013-4152 is a vulnerability in the Pivotal Spring Framework that allows a remote attacker to obtain sensitive information and conduct CSRF attacks.
What is the severity of CVE-2013-4152?
The severity of CVE-2013-4152 is medium, with a CVSS score of 6.8.
How does CVE-2013-4152 work?
CVE-2013-4152 works by exploiting the Spring OXM wrapper in Spring Framework before version 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, which does not disable entity resolution.
How can I fix CVE-2013-4152?
To fix CVE-2013-4152, update to Spring Framework version 3.2.4 or later.
Where can I find more information about CVE-2013-4152?
You can find more information about CVE-2013-4152 on the CVE website, NVD website, Pivotal's security advisory, and the GitHub and JIRA pages associated with the vulnerability.