CVE-2014-8125: Other (NVD-CWE-Other)
value: XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2015-04-21T17:59Z
Repository: https://github.com/droolsjbpm/drools
Language: Java
Files changed: drools-core/src/main/java/org/drools/core/xml/ExtensibleXmlParser.java
Commit date: 2014-12-22 14:17:52 +0100
Commit message: BZ-1169553 - (CVE-2014-8125) EMBARGOED CVE-2014-8125 jBPM: BPMN2 file processing XXE in Process Execution

Diff: diff --git a/drools-core/src/main/java/org/drools/core/xml/ExtensibleXmlParser.java b/drools-core/src/main/java/org/drools/core/xml/ExtensibleXmlParser.java
index 6d270c465..03c4b6002 100644
--- a/drools-core/src/main/java/org/drools/core/xml/ExtensibleXmlParser.java
+++ b/drools-core/src/main/java/org/drools/core/xml/ExtensibleXmlParser.java
@@ -221,11 +221,19 @@ public class ExtensibleXmlParser extends DefaultHandler {
                 }
             } catch ( Exception e ) {
                 throw new RuntimeException( "Unable to create new DOM Document",
                                             e );
             }
-            
+            // XXE protection start
+            try {
+                f.setFeature("http://xml.org/sax/features/external-general-entities", false);
+                f.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+
+            } catch (ParserConfigurationException e) {
+                logger.warn("Unable to set parser features due to {}", e.getMessage());
+            }
+            // XXE protection end
             try {
                 this.document = f.newDocumentBuilder().newDocument();
             } catch ( Exception e ) {
                 throw new RuntimeException( "Unable to create new DOM Document",
                                             e );
@@ -252,10 +260,19 @@ public class ExtensibleXmlParser extends DefaultHandler {
                 throw new RuntimeException( "Unable to create new DOM Document",
                                             e );
             }
             
             factory.setNamespaceAware( true );
+            // XXE protection start
+            try {
+                factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+                factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+
+            } catch (ParserConfigurationException e) {
+                logger.warn("Unable to set parser features due to {}", e.getMessage());
+            }
+            // XXE protection end
 
             final String isValidatingString = System.getProperty( "drools.schema.validating" );
             if ( System.getProperty( "drools.schema.validating" ) != null ) {
                 this.isValidating = Boolean.getBoolean( "drools.schema.validating" );
             }

Fixed code:             // XXE protection start
            try {
                f.setFeature("http://xml.org/sax/features/external-general-entities", false);
                f.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

            } catch (ParserConfigurationException e) {
                logger.warn("Unable to set parser features due to {}", e.getMessage());
            }
            // XXE protection end
            // XXE protection start
            try {
                factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
                factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

            } catch (ParserConfigurationException e) {
                logger.warn("Unable to set parser features due to {}", e.getMessage());
            }
            // XXE protection end