CVE-2013-7315: CSRF
It was found that Spring MVC processed user-provided XML with JAXB, in combination with a StAX XMLInputFactory, without disabling external entity resolution. A remote attacker could use this flaw to conduct XML External Entity (XXE) attacks on web sites, and read files in the context of the user running the application server. This flaw affects Spring Framework 3.2.x before 3.2.4 and 4.0.0.M1 through 4.0.0.M2.
Other sources
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Spring Frameworkto a version that resolves this vulnerability.Fixed in 3.2.4 - Upgrade
Upgrade
maven/org.springframework:spring-oxmto a version that resolves this vulnerability.Fixed in 3.2.4.RELEASE - Upgrade
Upgrade
Spring Framework (Spring MVC)to a version that resolves this vulnerability.Fixed in 3.2.4 - Upgrade
Upgrade
Spring Framework (Spring MVC)to a version that resolves this vulnerability.Fixed in 4.0.0.M2 - Compensating control
If upgrading is not immediately possible, configure Spring MVC’s XML processing to disable external entity resolution for the StAX XMLInputFactory used with JAXB when processing user-provided XML (to prevent XXE attacks).
Event History
Frequently Asked Questions
What is CVE-2013-7315?
CVE-2013-7315 is a vulnerability in the Spring Framework that allows remote attackers to obtain sensitive information and conduct CSRF attacks.
What is the severity of CVE-2013-7315?
The severity of CVE-2013-7315 is medium with a CVSS score of 6.8.
How does CVE-2013-7315 affect the Spring Framework?
CVE-2013-7315 affects Spring MVC in Spring Framework versions before 3.2.4 and 4.0.0.M1 through 4.0.0.M2.
What is the impact of CVE-2013-7315?
The impact of CVE-2013-7315 includes reading arbitrary files, causing a denial of service, and conducting CSRF attacks.
How can I fix CVE-2013-7315?
To fix CVE-2013-7315, update your Spring Framework to version 3.2.4 or apply the recommended remedy from Red Hat.