CVE-2023-46502: Improper Restriction of XML External Entity Reference (CWE-611)
value: An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2023-10-30T23:15Z
Repository: https://github.com/opencrx/opencrx
Language: Java
Files changed: core/src/main/java/org/opencrx/application/uses/net/sf/webdav/methods/WebDavMethod.java
Commit date: 2023-10-20 09:27:17 +0200
Commit message: fixes XML eXternal Entity injection (XXE)

Diff: diff --git a/core/src/main/java/org/opencrx/application/uses/net/sf/webdav/methods/WebDavMethod.java b/core/src/main/java/org/opencrx/application/uses/net/sf/webdav/methods/WebDavMethod.java
index 8fe55705..d7264e53 100644
--- a/core/src/main/java/org/opencrx/application/uses/net/sf/webdav/methods/WebDavMethod.java
+++ b/core/src/main/java/org/opencrx/application/uses/net/sf/webdav/methods/WebDavMethod.java
@@ -219,20 +219,44 @@ public abstract class WebDavMethod {
             path = path.substring(0, path.length() - 1);
         return path;
     }
 
     /**
-     * Return JAXP document builder instance.
+     * Get XML document builder.
+     * 
+     * @return
+     * @throws ServiceException
      */
     protected DocumentBuilder getDocumentBuilder(
     ) throws ServiceException {
         DocumentBuilder documentBuilder = null;
         DocumentBuilderFactory documentBuilderFactory = null;
+        documentBuilderFactory = DocumentBuilderFactory.newInstance();
+        documentBuilderFactory.setNamespaceAware(true);
+        // Flags required to prevent XML eXternal Entity injection (XXE)
+        try {
+        	documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        } catch (ParserConfigurationException e) {
+            throw new ServiceException(e);
+        }
+        try {
+        	documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        } catch (ParserConfigurationException e) {
+            throw new ServiceException(e);
+        }
+        try {
+        	documentBuilderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        } catch (ParserConfigurationException e) {
+            throw new ServiceException(e);
+        }
+        try {
+        	documentBuilderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+        } catch (ParserConfigurationException e) {
+            throw new ServiceException(e);
+        }
         try {
-            documentBuilderFactory = DocumentBuilderFactory.newInstance();
-            documentBuilderFactory.setNamespaceAware(true);
-            documentBuilder = documentBuilderFactory.newDocumentBuilder();
+        	documentBuilder = documentBuilderFactory.newDocumentBuilder();
         } catch (ParserConfigurationException e) {
             throw new ServiceException(e);
         }
         return documentBuilder;
     }

Vulnerable code:      * Return JAXP document builder instance.
            documentBuilderFactory = DocumentBuilderFactory.newInstance();
            documentBuilderFactory.setNamespaceAware(true);
            documentBuilder = documentBuilderFactory.newDocumentBuilder();
Fixed code:      * Get XML document builder.
     * 
     * @return
     * @throws ServiceException
        documentBuilderFactory = DocumentBuilderFactory.newInstance();
        documentBuilderFactory.setNamespaceAware(true);
        // Flags required to prevent XML eXternal Entity injection (XXE)
        try {
        	documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        } catch (ParserConfigurationException e) {
            throw new ServiceException(e);
        }
        try {
        	documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
        } catch (ParserConfigurationException e) {
            throw new ServiceException(e);
        }
        try {
        	documentBuilderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        } catch (ParserConfigurationException e) {
            throw new ServiceException(e);
        }
        try {
        	documentBuilderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
        } catch (ParserConfigurationException e) {
            throw new ServiceException(e);
        }
        	documentBuilder = documentBuilderFactory.newDocumentBuilder();