CVE-2013-6448: Permissions, Privileges, and Access Controls (CWE-264)
value: The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allows remote attackers to bypass the WebRemote annotation restriction and obtain information about arbitrary classes and methods on the server classpath via unspecified vectors.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2014-01-23T00:55Z
Repository: https://github.com/seam2/jboss-seam
Language: Java
Files changed: jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java, jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java, jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java, jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java, jboss-seam/src/main/java/org/jboss/seam/util/XML.java
Commit date: 2014-01-21 16:45:36 +0100
Commit message: https://issues.jboss.org/browse/WFK2-375 enhanced fix

git-svn-id: https://svn.jboss.org/repos/seam/branches/enterprise/WFK-2_1@15651 a9c07ecc-ef43-0410-a306-c911db474e88

Diff: diff --git a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java
index 7a40c5d43..1b399c6dd 100644
--- a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java
+++ b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java
@@ -19,10 +19,11 @@ import org.jboss.seam.core.ConversationPropagation;
 import org.jboss.seam.core.Manager;
 import org.jboss.seam.log.LogProvider;
 import org.jboss.seam.log.Logging;
 import org.jboss.seam.remoting.wrapper.Wrapper;
 import org.jboss.seam.servlet.ContextualHttpServletRequest;
+import org.jboss.seam.util.XML;
 
 /**
  * Unmarshals the calls from an HttpServletRequest, executes them in order and
  * marshals the responses.
  *
@@ -65,11 +66,11 @@ public class ExecutionHandler extends BaseRequestHandler implements RequestHandl
       
       String requestData = new String(out.toByteArray());
       log.debug("Processing remote request: " + requestData);
       
       // Parse the incoming request as XML
-      SAXReader xmlReader = new SAXReader();
+      SAXReader xmlReader = XML.getSafeSaxReader();
       Document doc = xmlReader.read( new StringReader(requestData) );
       final Element env = doc.getRootElement();
       final RequestContext ctx = unmarshalContext(env);
 
       // TODO - we really want to extract the page context from our request
diff --git a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java
index d9bfcc0e2..0736a069f 100644
--- a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java
+++ b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java
@@ -86,20 +86,12 @@ public class InterfaceGenerator extends BaseRequestHandler implements RequestHan
               String componentName = ((String) e.nextElement()).trim();
               
               Component component = Component.forName(componentName);
               if (component == null)
               {                 
-                 try
-                 {
-                    Class c = Reflections.classForName(componentName);
-                    appendClassSource(response.getOutputStream(), c, types);
-                 }
-                 catch (ClassNotFoundException ex)
-                 {
-                    log.error(String.format("Component not found: [%s]", componentName));
-                    throw new ServletException("Invalid request - component not found.");
-                 }
+                 log.error(String.format("Component not found: [%s]", componentName));
+                 throw new ServletException("Invalid request - component not found.");
               }
               else
               {
                  components.add(component);
               }
diff --git a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java
index 3e9603071..0de4482d4 100644
--- a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java
+++ b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java
@@ -19,10 +19,11 @@ import org.jboss.seam.log.LogProvider;
 import org.jboss.seam.log.Logging;
 import org.jboss.seam.remoting.messaging.PollError;
 import org.jboss.seam.remoting.messaging.PollRequest;
 import org.jboss.seam.remoting.wrapper.Wrapper;
 import org.jboss.seam.servlet.ContextualHttpServletRequest;
+import org.jboss.seam.util.XML;
 
 /**
  * Handles JMS Message poll requests.
  *
  * @author Shane Bryzak
@@ -54,11 +55,11 @@ public class PollHandler extends BaseRequestHandler implements RequestHandler
   {
     // We're sending an XML response, so set the response content type to text/xml
     response.setContentType("text/xml");
 
     // Parse the incoming request as XML
-    SAXReader xmlReader = new SAXReader();
+    SAXReader xmlReader = XML.getSafeSaxReader();
     Document doc = xmlReader.read(request.getInputStream());
     Element env = doc.getRootElement();
 
     final List<PollRequest> polls = unmarshalRequests(env);
 
diff --git a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java
index 2035d7cd5..b4bc47db0 100644
--- a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java
+++ b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java
@@ -15,10 +15,11 @@ import org.jboss.seam.contexts.Lifecycle;
 import org.jboss.seam.contexts.ServletLifecycle;
 import org.jboss.seam.core.Manager;
 import org.jboss.seam.remoting.messaging.RemoteSubscriber;
 import org.jboss.seam.remoting.messaging.SubscriptionRegistry;
 import org.jboss.seam.remoting.messaging.SubscriptionRequest;
+import org.jboss.seam.util.XML;
 import org.jboss.seam.web.ServletContexts;
 
 /**
  *
  * @author Shane Bryzak
@@ -38,11 +39,11 @@ public class SubscriptionHandler extends BaseRequestHandler implements RequestHa
   {
     // We're sending an XML response, so set the response content type to text/xml
     response.setContentType("text/xml");
 
     // Parse the incoming request as XML
-    SAXReader xmlReader = new SAXReader();
+    SAXReader xmlReader = XML.getSafeSaxReader();
     Document doc = xmlReader.read(request.getInputStream());
     Element env = doc.getRootElement();
 
     Element body = env.element("body");
 
diff --git a/jboss-seam/src/main/java/org/jboss/seam/util/XML.java b/jboss-seam/src/main/java/org/jboss/seam/util/XML.java
index 3544c261e..da737ba63 100644
--- a/jboss-seam/src/main/java/org/jboss/seam/util/XML.java
+++ b/jboss-seam/src/main/java/org/jboss/seam/util/XML.java
@@ -63,6 +63,19 @@ public class XML
        {
            return new InputSource(new ByteArrayInputStream(empty));
        }
 
    }
+   
+   /**
+    * Get safe SaxReader with doctype feature disabled 
+    * @see http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl 
+    * @return
+    * @throws Exception
+    */
+   public static SAXReader getSafeSaxReader() throws Exception
+   {
+      SAXReader xmlReader = new SAXReader();
+      xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+      return xmlReader;
+   }
 }

Vulnerable code:       SAXReader xmlReader = new SAXReader();
                 try
                 {
                    Class c = Reflections.classForName(componentName);
                    appendClassSource(response.getOutputStream(), c, types);
                 }
                 catch (ClassNotFoundException ex)
                 {
                    log.error(String.format("Component not found: [%s]", componentName));
                    throw new ServletException("Invalid request - component not found.");
                 }
    SAXReader xmlReader = new SAXReader();
    SAXReader xmlReader = new SAXReader();
Fixed code: import org.jboss.seam.util.XML;
      SAXReader xmlReader = XML.getSafeSaxReader();
                 log.error(String.format("Component not found: [%s]", componentName));
                 throw new ServletException("Invalid request - component not found.");
import org.jboss.seam.util.XML;
    SAXReader xmlReader = XML.getSafeSaxReader();
import org.jboss.seam.util.XML;
    SAXReader xmlReader = XML.getSafeSaxReader();
   
   /**
    * Get safe SaxReader with doctype feature disabled 
    * @see http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl 
    * @return
    * @throws Exception
    */
   public static SAXReader getSafeSaxReader() throws Exception
   {
      SAXReader xmlReader = new SAXReader();
      xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
      return xmlReader;
   }