CVE-2013-6447: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Multiple XML External Entity (XXE) vulnerabilities in the (1) ExecutionHandler, (2) PollHandler, and (3) SubscriptionHandler classes in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allow remote attackers to read arbitrary files and possibly have other impacts via a crafted XML file.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2014-01-23T00:55Z
Repository: https://github.com/seam2/jboss-seam
Language: Java
Files changed: jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java, jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java, jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java, jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java, jboss-seam/src/main/java/org/jboss/seam/util/XML.java
Commit date: 2014-01-21 16:45:36 +0100
Commit message: https://issues.jboss.org/browse/WFK2-375 enhanced fix

git-svn-id: https://svn.jboss.org/repos/seam/branches/enterprise/WFK-2_1@15651 a9c07ecc-ef43-0410-a306-c911db474e88

Diff: diff --git a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java
index 7a40c5d43..1b399c6dd 100644
--- a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java
+++ b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/ExecutionHandler.java
@@ -19,10 +19,11 @@ import org.jboss.seam.core.ConversationPropagation;
 import org.jboss.seam.core.Manager;
 import org.jboss.seam.log.LogProvider;
 import org.jboss.seam.log.Logging;
 import org.jboss.seam.remoting.wrapper.Wrapper;
 import org.jboss.seam.servlet.ContextualHttpServletRequest;
+import org.jboss.seam.util.XML;
 
 /**
  * Unmarshals the calls from an HttpServletRequest, executes them in order and
  * marshals the responses.
  *
@@ -65,11 +66,11 @@ public class ExecutionHandler extends BaseRequestHandler implements RequestHandl
       
       String requestData = new String(out.toByteArray());
       log.debug("Processing remote request: " + requestData);
       
       // Parse the incoming request as XML
-      SAXReader xmlReader = new SAXReader();
+      SAXReader xmlReader = XML.getSafeSaxReader();
       Document doc = xmlReader.read( new StringReader(requestData) );
       final Element env = doc.getRootElement();
       final RequestContext ctx = unmarshalContext(env);
 
       // TODO - we really want to extract the page context from our request
diff --git a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java
index d9bfcc0e2..0736a069f 100644
--- a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java
+++ b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/InterfaceGenerator.java
@@ -86,20 +86,12 @@ public class InterfaceGenerator extends BaseRequestHandler implements RequestHan
               String componentName = ((String) e.nextElement()).trim();
               
               Component component = Component.forName(componentName);
               if (component == null)
               {                 
-                 try
-                 {
-                    Class c = Reflections.classForName(componentName);
-                    appendClassSource(response.getOutputStream(), c, types);
-                 }
-                 catch (ClassNotFoundException ex)
-                 {
-                    log.error(String.format("Component not found: [%s]", componentName));
-                    throw new ServletException("Invalid request - component not found.");
-                 }
+                 log.error(String.format("Component not found: [%s]", componentName));
+                 throw new ServletException("Invalid request - component not found.");
               }
               else
               {
                  components.add(component);
               }
diff --git a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java
index 3e9603071..0de4482d4 100644
--- a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java
+++ b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/PollHandler.java
@@ -19,10 +19,11 @@ import org.jboss.seam.log.LogProvider;
 import org.jboss.seam.log.Logging;
 import org.jboss.seam.remoting.messaging.PollError;
 import org.jboss.seam.remoting.messaging.PollRequest;
 import org.jboss.seam.remoting.wrapper.Wrapper;
 import org.jboss.seam.servlet.ContextualHttpServletRequest;
+import org.jboss.seam.util.XML;
 
 /**
  * Handles JMS Message poll requests.
  *
  * @author Shane Bryzak
@@ -54,11 +55,11 @@ public class PollHandler extends BaseRequestHandler implements RequestHandler
   {
     // We're sending an XML response, so set the response content type to text/xml
     response.setContentType("text/xml");
 
     // Parse the incoming request as XML
-    SAXReader xmlReader = new SAXReader();
+    SAXReader xmlReader = XML.getSafeSaxReader();
     Document doc = xmlReader.read(request.getInputStream());
     Element env = doc.getRootElement();
 
     final List<PollRequest> polls = unmarshalRequests(env);
 
diff --git a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java
index 2035d7cd5..b4bc47db0 100644
--- a/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java
+++ b/jboss-seam-remoting/src/main/java/org/jboss/seam/remoting/SubscriptionHandler.java
@@ -15,10 +15,11 @@ import org.jboss.seam.contexts.Lifecycle;
 import org.jboss.seam.contexts.ServletLifecycle;
 import org.jboss.seam.core.Manager;
 import org.jboss.seam.remoting.messaging.RemoteSubscriber;
 import org.jboss.seam.remoting.messaging.SubscriptionRegistry;
 import org.jboss.seam.remoting.messaging.SubscriptionRequest;
+import org.jboss.seam.util.XML;
 import org.jboss.seam.web.ServletContexts;
 
 /**
  *
  * @author Shane Bryzak
@@ -38,11 +39,11 @@ public class SubscriptionHandler extends BaseRequestHandler implements RequestHa
   {
     // We're sending an XML response, so set the response content type to text/xml
     response.setContentType("text/xml");
 
     // Parse the incoming request as XML
-    SAXReader xmlReader = new SAXReader();
+    SAXReader xmlReader = XML.getSafeSaxReader();
     Document doc = xmlReader.read(request.getInputStream());
     Element env = doc.getRootElement();
 
     Element body = env.element("body");
 
diff --git a/jboss-seam/src/main/java/org/jboss/seam/util/XML.java b/jboss-seam/src/main/java/org/jboss/seam/util/XML.java
index 3544c261e..da737ba63 100644
--- a/jboss-seam/src/main/java/org/jboss/seam/util/XML.java
+++ b/jboss-seam/src/main/java/org/jboss/seam/util/XML.java
@@ -63,6 +63,19 @@ public class XML
        {
            return new InputSource(new ByteArrayInputStream(empty));
        }
 
    }
+   
+   /**
+    * Get safe SaxReader with doctype feature disabled 
+    * @see http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl 
+    * @return
+    * @throws Exception
+    */
+   public static SAXReader getSafeSaxReader() throws Exception
+   {
+      SAXReader xmlReader = new SAXReader();
+      xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+      return xmlReader;
+   }
 }

Vulnerable code:       SAXReader xmlReader = new SAXReader();
                 try
                 {
                    Class c = Reflections.classForName(componentName);
                    appendClassSource(response.getOutputStream(), c, types);
                 }
                 catch (ClassNotFoundException ex)
                 {
                    log.error(String.format("Component not found: [%s]", componentName));
                    throw new ServletException("Invalid request - component not found.");
                 }
    SAXReader xmlReader = new SAXReader();
    SAXReader xmlReader = new SAXReader();
Fixed code: import org.jboss.seam.util.XML;
      SAXReader xmlReader = XML.getSafeSaxReader();
                 log.error(String.format("Component not found: [%s]", componentName));
                 throw new ServletException("Invalid request - component not found.");
import org.jboss.seam.util.XML;
    SAXReader xmlReader = XML.getSafeSaxReader();
import org.jboss.seam.util.XML;
    SAXReader xmlReader = XML.getSafeSaxReader();
   
   /**
    * Get safe SaxReader with doctype feature disabled 
    * @see http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl 
    * @return
    * @throws Exception
    */
   public static SAXReader getSafeSaxReader() throws Exception
   {
      SAXReader xmlReader = new SAXReader();
      xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
      return xmlReader;
   }