CVE-2020-36641: Improper Restriction of XML External Entity Reference (CWE-611)
value: A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.14.0 is able to address this issue. The patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2023-01-05T12:15Z
Repository: https://github.com/gturri/aXMLRPC
Language: Other
Files changed: Changelog, pom.xml, src/main/java/de/timroes/axmlrpc/ResponseParser.java
Commit date: 2024-01-25 21:37:55 +0100
Commit message: Fix CWE-611

This commit fixes the issue described on
https://cwe.mitre.org/data/definitions/611.html

Nb: it's mostly the same as ad6615b3ec41353e614f6ea5fdd5b046442a832b but
with an added reference to org.apache.xerces in order to avoid the
AbstractMethodError that was experienced by users back then.

Nb2: writting down the payload with which I tested this patch, in case I
need to run this test again in the future:

    <?xml version="1.0"?>
    <!DOCTYPE replace [<!ENTITY ent SYSTEM "http://localhost/malware"> ]>
    <methodResponse>
        <params>
            <param>
               <value><string>&ent;</string></value>
            </param>
        </params>
    </methodResponse>

Diff: diff --git a/Changelog b/Changelog
index 67833b2..a372879 100644
--- a/Changelog
+++ b/Changelog
@@ -1,5 +1,6 @@
+Fix security issue CWE-611
 Add support for CDATA section in the server response
 
 1.13.0
 DateTime serializer format is now injectable
 
diff --git a/pom.xml b/pom.xml
index b065300..ccacc48 100644
--- a/pom.xml
+++ b/pom.xml
@@ -40,10 +40,15 @@
 		<dependency>
 			<groupId>fr.turri</groupId>
 			<artifactId>jISO8601</artifactId>
 			<version>0.2</version>
 		</dependency>
+        <dependency>
+            <groupId>xerces</groupId>
+            <artifactId>xercesImpl</artifactId>
+            <version>2.12.2</version>
+        </dependency>
         <dependency>
           <groupId>com.github.tomakehurst</groupId>
           <artifactId>wiremock-jre8</artifactId>
           <version>2.28.0</version>
           <scope>test</scope>
diff --git a/src/main/java/de/timroes/axmlrpc/ResponseParser.java b/src/main/java/de/timroes/axmlrpc/ResponseParser.java
index 6feef08..6117937 100644
--- a/src/main/java/de/timroes/axmlrpc/ResponseParser.java
+++ b/src/main/java/de/timroes/axmlrpc/ResponseParser.java
@@ -8,10 +8,11 @@ import java.io.OutputStream;
 import java.io.OutputStreamWriter;
 import java.util.Map;
 
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
 import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
@@ -43,13 +44,21 @@ public class ResponseParser {
 	 * @throws XMLRPCServerException Will be thrown, if the server returns an error.
 	 */
 	public Object parse(SerializerHandler serializerHandler, InputStream response, boolean debugMode) throws XMLRPCException {
 
 		try {
-
 			DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+
+			// Ensure the xml parser won't allow exploitation of the vuln CWE-611
+			// (described on https://cwe.mitre.org/data/definitions/611.html )
+			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+			factory.setExpandEntityReferences(false);
 			factory.setNamespaceAware(true);
+			factory.setXIncludeAware(false);
+			factory.setExpandEntityReferences(false);
+			// End of the configuration of the parser for CWE-611
+
 			DocumentBuilder builder = factory.newDocumentBuilder();
 			Document dom = builder.parse(response);
 			if (debugMode ){
 				printDocument(dom, System.out);
 			}

Fixed code: Fix security issue CWE-611
        <dependency>
            <groupId>xerces</groupId>
            <artifactId>xercesImpl</artifactId>
            <version>2.12.2</version>
        </dependency>
import javax.xml.parsers.ParserConfigurationException;

			// Ensure the xml parser won't allow exploitation of the vuln CWE-611
			// (described on https://cwe.mitre.org/data/definitions/611.html )
			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
			factory.setExpandEntityReferences(false);
			factory.setXIncludeAware(false);
			factory.setExpandEntityReferences(false);
			// End of the configuration of the parser for CWE-611