Описание
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any wsdl:import or xsd:import referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
A flaw was found in Apache CXF. The framework's initial processing of a Web Services Description Language (WSDL) document disables XML DTDs (Document Type Definitions) and external entities. However, any WSDL or XML Schema Definition (XSD) documents imported by the top-level WSDL are processed by a different component, WSDL4J, which does not apply these same security protections. This oversight allows an attacker to exploit XML External Entity (XXE) vulnerabilities through imported WSDL/XSD content, potentially leading to information disclosure or denial of service.
Отчет
Apache CXF is affected by an XML External Entity (XXE) vulnerability when processing imported WSDL/XSD content. The vulnerability exists because WSDL4J, which Apache CXF uses to parse WSDL imports, lacks restrictions on DTD declarations and external entity references. An attacker can exploit this to read arbitrary files or conduct denial of service attacks. Note that this requires the application to process untrusted WSDL/XSD imports and have the WSDL4J library on the classpath.
Меры по смягчению последствий
Update Apache CXF to a version that includes the fix. Disable DTD processing and external entity resolution in XML parsers. Avoid processing untrusted WSDL/XSD imports.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel 4 for Quarkus 3 | camel-cxf-common | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | camel-cxf-soap | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | camel-cxf-transport | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | camel-quarkus-cxf-soap | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | camel-quarkus-cxf-soap-deployment | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | cxf-core | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | cxf-integration-tracing-opentelemetry | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | cxf-rt-bindings-soap | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | cxf-rt-bindings-xml | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | cxf-rt-databinding-jaxb | Affected |
Показывать по
Дополнительная информация
Статус:
8.6 High
CVSS3
Связанные уязвимости
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
8.6 High
CVSS3