Description

When processing user provided XML documents, the Spring Framework did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

Affected Spring Products and Versions

• Spring MVC 3.0.0 to 3.2.8
• Spring MVC 4.0.0 to 4.0.4
• Earlier unsupported versions may be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.9 or later
• Users of 4.x should upgrade to 4.0.5 or later

Credit

This issue was discovered and reported responsibly to the Pivotal security team by Nebula(XIAOBAISHAN,CHIBI,HUBEI.CN) HelloWorld security team, DBappsecurity.com security team. Additional…

Description

Spring MVC's Jaxb2RootElementHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. Jaxb2RootElementHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default.

Affected Spring Products and Versions

• Spring MVC 3.0.0 to 3.2.7
• Spring MVC 4.0.0 to 4.0.1
• Earlier unsupported versions may be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.8 or later
• Users of 4.x should upgrade to 4.0.2 or later

Credit

This issue was reported to the Spring Framework developers by Spase Markovski.

References

• https://jira.springsource.org/browse/SPR-11376
• https://github.com/spring-projects/spring-framework/commit/edba32b3093703d5e9ed42b5b8ec23ecc1998398#diff-1f3f1d5cdab9ac92d1ca5ec7def8f131
• https://github.com/spring-projects/spring…

Description

The ActiveDirectoryLdapAuthenticator does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

Affected Spring Products and Versions

• Spring Security 3.2.0 to 3.2.1
• Spring Security 3.1.0 to 3.1.5

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.2.x should upgrade to 3.2.2 or later
• Users of 3.1.x should upgrade to 3.1.6 or later

Credit

This issue was identified by the Spring Development team.

References

• https://jira.springsource.org/browse/SEC-2500
• https://github.com/spring-projects/spring-security/commit/88559882e967085c47a7e1dcbc4dc32c2c796868
• https://github.com/spring-projects/spring-security/commit/7dbb8e777ece8675f3333a1ef1cb4d6b9be80395
• …

Description

When a programmer does not specify the action on the Spring form, Spring automatically populates the action field with the requested uri. An attacker can use this to inject malicious content into the form.

Affected Spring Products and Versions

• Spring MVC 3.0.0 to 3.2.7
• Spring MVC 4.0.0 to 4.0.1
• Earlier unsupported versions may be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.8 or later
• Users of 4.x should upgrade to 4.0.2 or later

Credit

This issue was discovered and reported responsibly to the Pivotal security team by Paul Wowk of CAaNES LLC.

References

• https://jira.springsource.org/browse/SPR-11426
• https://github.com/spring-projects/spring-framework/commit/741b4b229ae032bd17175b46f98673ce0bd2d485
• https://github.com/spring-projects/spring-framework/commit…

Description

Spring MVC's SourceHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. SourceHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default. It was subsequently discovered that this fix was also incomplete (CVE-2014-0054).

Affected Spring Products and Versions

• Spring MVC 3.0.0 to 3.2.4
• Spring MVC 4.0.0.M1-4.0.0.RC1
• Earlier unsupported versions may be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.5 or later
• Users of 4.x should upgrade to 4.0.0 or later (This is also fixed in 4.0.0-RC2 but users are recommended to use 4.0.0 or later)
• To fully mitigate this issue (including CVE-2014-0054), users of 3.x should upgrade to 3.2.8 or later and users of 4.x should upgrade to 4.0.2 or later.

Credit

This issue was identified by the Spring development team.

References

• https://jira.springsource.org/browse/SPR-11078

History

2014-Jan-15: Initial vulnerability report.

• 2014-Jun-19: Update to reflect split of CVE-2013-4152 into CVE-2013-4152 and CVE-2013-7315. Added information on additional vulnerability report that identified that this fix was incomplete.
…

Description

The JavaScriptUtils.javaScriptEscape() method did not escape all characters that are sensitive within either a JS single quoted string, JS double quoted string, or HTML script data context. In most cases this will result in an unexploitable parse error but in some cases it could result in an XSS vulnerability.

Affected Spring Products and Versions

• Spring MVC 3.0.0 to 3.2.1
• Earlier unsupported versions may be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.2 or later

Credit

This issue was originally reported to the Spring Framework developers by Jon Passki and the security implications brough to the attention of the Pivotal security team by Arun Neelicattu.

…

Description

The Spring OXM wrapper did not expose any property for disabling entity resolution when using the JAXB unmarshaller. There are four possible source implementations passed to the unmarshaller: DOMSource, StAXSource, SAXSource and StreamSource.

For a DOMSource, the XML has already been parsed by user code and that code is responsible for protecting against XXE.

For a StAXSource, the XMLStreamReader has already been created by user code and that code is responsible for protecting against XXE.

For SAXSource and StreamSource instances, Spring processed external entities by default thereby creating this vulnerability.

The issue was resolved by disabling external entity processing by default and adding an option to enable it for those users that need to use this feature when processing XML from a trusted source.

Affected Spring Products and Versions

• 3.0.0 to 3.2.3
• 4.0.0.M1
• Earlier unsupported versions may be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.4 or later
• Users of 4.x should upgrade to 4.0.0.M2 or later

Credit

These issues were identified by Alvaro Munoz of the HP Enterprise Security Team.

References

• https://github.com/SpringSource/spring-framework/pull/317

History

2013-Aug-22: Initial…

Description

It was identified that Spring MVC processed user provided XML with JAXB in combination with a StAX XMLInputFactory without disabling external entity resolution. External entity resolution has been disabled in this case. It was subsequently discovered that this fix was incomplete (CVE-2013-6429, CVE-2014-0054).

Affected Spring Products and Versions

• 3.2.0 to 3.2.3
• 4.0.0.M1-4.0.0.M2 (Spring MVC)
• Earlier unsupported versions may be affected

Mitigation

Users of affected versions should apply the following mitigation:

• Users of 3.x should upgrade to 3.2.4 or later
• Users of 4.x should upgrade to 4.0.0.RC1 or later
• To fully mitigate this issue (including CVE-2013-6429 & CVE-2014-0054), users of 3.x should upgrade to 3.2.8 or later and users of 4.x should upgrade to 4.0.2 or later.

Credit

These issues were identified by Alvaro Munoz of the HP Enterprise Security Team.

References

• https://jira.springsource.org/browse/SPR-10806

History

2013-Aug-22: Initial vulnerability…