CVE-2013-6429: CSRF
It was found that the Spring MVC SourceHttpMessageConverter processed user-provided XML, and did not expose any property for disabling entity resolution in the XML. A remote attacker could use this flaw to conduct XML External Entity (XXE) attacks on web sites, and read files in the context of the user running the application server. The patch for this flaw disables external entity processing by default, and provides a configuration directive to re-enable it. This flaw is considered to be the result of an incomplete fix for CVE-2013-4152.
Other sources
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.springframework:spring-webto a version that resolves this vulnerability.Fixed in 3.2.5.RELEASE - Upgrade
Upgrade
Spring Framework - Spring MVC SourceHttpMessageConverterto a version that resolves this vulnerability.Fixed in 3.2.5 - Upgrade
Upgrade
Spring Framework - Spring MVC SourceHttpMessageConverterto a version that resolves this vulnerability.Fixed in 4.0.0.M1 - Upgrade
Upgrade
Spring Framework - Spring MVC SourceHttpMessageConverterto a version that resolves this vulnerability.Fixed in 4.0.0.RC1 - Configuration
Ensure SourceHttpMessageConverter has external entity processing disabled by default; if re-enabling is absolutely necessary, use the configuration directive provided by the patch to re-enable external entity processing.
Spring MVC (Spring Framework) - SourceHttpMessageConverter external entity processing / entity resolution = disabled by default (re-enable only if required)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2013-6429?
The severity of CVE-2013-6429 is medium with a score of 6.8.
How does CVE-2013-6429 impact Spring Framework?
CVE-2013-6429 allows remote attackers to read arbitrary files, cause denial of service, and conduct CSRF attacks via crafted XML.
Which versions of Spring Framework are affected by CVE-2013-6429?
Spring Framework versions before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 are affected by CVE-2013-6429.
Is there a fix available for CVE-2013-6429?
Yes, updating to Spring Framework version 3.2.5 or newer, or version 4.0.0.RC2 or newer, will fix CVE-2013-6429.
Where can I find more information about CVE-2013-6429?
You can find more information about CVE-2013-6429 on the Red Hat Security website, the Spring Framework GitHub repository, and the Pivotal website.