CVE-2014-0054: CSRF
Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection (XXE) error in Jaxb2RootElementHttpMessageConverter when processing XML data. By sending specially-crafted XML data, an attacker could exploit this vulnerability to read arbitrary files and obtain sensitive information.
Other sources
The fixes for the CVE-2013-7315 (bug 1061509) and CVE-2013-6429 (bug 1053290) XML External Entity (XXE) issues were found to be incomplete. From the original advisory:
"Spring MVC's Jaxb2RootElementHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. Jaxb2RootElementHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default."
This issue affects versions 3.0.0 to 3.2.8, and versions 4.0.0 to 4.0.1.
External References:
http://www.gopivotal.com/security/cve-2014-0054
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/spring mvcto a version that resolves this vulnerability.Fixed in 3.2.8 - Upgrade
Upgrade
redhat/spring mvcto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
maven/org.springframework:spring-webmvcto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
maven/org.springframework:spring-webmvcto a version that resolves this vulnerability.Fixed in 3.2.8 - Upgrade
Upgrade
Spring Framework (Spring MVC)to a version that resolves this vulnerability.Fixed in 3.2.8 - Upgrade
Upgrade
Spring Framework (Spring MVC)to a version that resolves this vulnerability.Fixed in 4.0.2 - Configuration
Ensure Jaxb2RootElementHttpMessageConverter has the modified behavior that controls XML external entity processing and has it disabled by default.
Jaxb2RootElementHttpMessageConverter (Spring MVC) processing of XML external entities (XXE) = disabled by default
Event History
Frequently Asked Questions
What is CVE-2014-0054?
CVE-2014-0054 is a vulnerability in the Pivotal Spring Framework that could allow a remote attacker to obtain sensitive information.
How does CVE-2014-0054 work?
CVE-2014-0054 is caused by the Jaxb2RootElementHttpMessageConverter in Spring MVC not disabling external entity resolution, allowing remote attackers to read arbitrary files, cause denial of service, and conduct CSRF attacks via crafted XML.
What is the severity of CVE-2014-0054?
The severity of CVE-2014-0054 is medium with a CVSS score of 6.8.
Which software versions are affected by CVE-2014-0054?
The Spring MVC versions 3.2.8 and 4.0.0 before 4.0.2, and IBM Security Directory Suite VA 8.0.1-8.0.1.19 are affected by CVE-2014-0054.
How can I fix CVE-2014-0054?
To fix CVE-2014-0054, upgrade the Spring MVC to version 3.2.8 or 4.0.2, or apply the appropriate remedy provided by your software vendor.