CVE-2013-6440: Infoleak
IssueDescription:
It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity (XXE) attacks. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
Other sources
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Shibboleth OpenSAML-Javato a version that resolves this vulnerability.Fixed in 2.6.1 - Configuration
In OpenSAML Java ParserPool/Decrypter components (BasicParserPool, StaticBasicParserPool, XML Decrypter, SAML Decrypter), set expandEntityReferences to false to prevent XXE via crafted XML DOCTYPE (these classes set it to true in versions before 2.6.1).
Shibboleth OpenSAML-Java expandEntityReferences = false
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6440?
CVE-2013-6440 is considered a high severity vulnerability due to its potential to allow remote attackers to read arbitrary files from the affected system.
How do I fix CVE-2013-6440?
To fix CVE-2013-6440, upgrade to OpenSAML version 2.5.0 or later, which addresses the XML External Entity (XXE) vulnerability.
What types of attacks can exploit CVE-2013-6440?
CVE-2013-6440 can be exploited through XML External Entity (XXE) attacks allowing attackers to access sensitive files on the server.
Which versions of OpenSAML are affected by CVE-2013-6440?
CVE-2013-6440 affects OpenSAML versions including 2.0, 2.1.0, 2.2.0, and any versions up to 2.6.0.
Is CVE-2013-6440 specific to certain configurations of OpenSAML?
No, CVE-2013-6440 affects the core classes of the OpenSAML implementation regardless of configuration.