CVE-2015-7326: Improper Restriction of XML External Entity Reference (CWE-611)
value: XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2017-06-07T14:29Z
Repository: https://github.com/miltonio/milton2
Language: Java
Files changed: milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropFindRequestFieldParser.java, milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropPatchParser.java
Commit date: 2015-09-26 10:04:35 +1200
Commit message: patch XXE vulnerability
Diff: diff --git a/milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropFindRequestFieldParser.java b/milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropFindRequestFieldParser.java
index bb37ad32..5ad7ba84 100644
--- a/milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropFindRequestFieldParser.java
+++ b/milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropFindRequestFieldParser.java
@@ -51,18 +51,21 @@ public class DefaultPropFindRequestFieldParser implements PropFindRequestFieldPa
     }
 
 	@Override
     public PropertiesRequest getRequestedFields( InputStream in ) {
 		final Set<QName> set = new LinkedHashSet<QName>();
-        try {            
+        try {
             ByteArrayOutputStream bout = new ByteArrayOutputStream();
             StreamUtils.readTo( in, bout, false, true );
             byte[] arr = bout.toByteArray();
             if( arr.length > 1 ) {
                 ByteArrayInputStream bin = new ByteArrayInputStream( arr );
                 XMLReader reader = XMLReaderFactory.createXMLReader();
 				reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+				// https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
+				reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+				reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
                 PropFindSaxHandler handler = new PropFindSaxHandler();
                 reader.setContentHandler( handler );
                 try {
                     reader.parse( new InputSource( bin ) );
                     if( handler.isAllProp() ) {
@@ -75,11 +78,11 @@ public class DefaultPropFindRequestFieldParser implements PropFindRequestFieldPa
                     // ignore
                 } catch( SAXException e ) {
                     log.warn( "exception parsing request body", e );
                     // ignore
                 }
-            }            
+            }
         } catch( Exception ex ) {
 			// There's a report of an exception being thrown here by IT Hit Webdav client
 			// Perhaps we can just log the error and return an empty set. Usually this
 			// class is wrapped by the MsPropFindRequestFieldParser which will use a default
 			// set of properties if this returns an empty set
diff --git a/milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropPatchParser.java b/milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropPatchParser.java
index 18b7c951..c3462002 100644
--- a/milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropPatchParser.java
+++ b/milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropPatchParser.java
@@ -67,10 +67,14 @@ public class DefaultPropPatchParser implements PropPatchRequestParser {
         if( arr.length > 0 ) {
             log.debug( "processing content" );
             ByteArrayInputStream bin = new ByteArrayInputStream( arr );
             XMLReader reader = XMLReaderFactory.createXMLReader();
 			reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+			// https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
+			reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+			reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+
             PropPatchSaxHandler handler = new PropPatchSaxHandler();
             reader.setContentHandler( handler );
             reader.parse( new InputSource( bin ) );
             log.debug( "toset: " + handler.getAttributesToSet().size());
             return new PropPatchParseResult( handler.getAttributesToSet(), handler.getAttributesToRemove().keySet() );

Vulnerable code:         try {            
            }            
Fixed code:         try {
				// https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
				reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
				reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
            }
			// https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
			reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
			reader.setFeature("http://xml.org/sax/features/external-general-entities", false);