CVE-2019-5748: Improper Restriction of XML External Entity Reference (CWE-611)
value: In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2019-01-09T17:29Z
Repository: https://github.com/traccar/traccar
Language: Java
Files changed: src/org/traccar/protocol/SpotProtocolDecoder.java
Commit date: 2019-01-04 11:24:47 -0800
Commit message: Fix potential security issue

Diff: diff --git a/src/org/traccar/protocol/SpotProtocolDecoder.java b/src/org/traccar/protocol/SpotProtocolDecoder.java
index 78b2b048..da36c204 100644
--- a/src/org/traccar/protocol/SpotProtocolDecoder.java
+++ b/src/org/traccar/protocol/SpotProtocolDecoder.java
@@ -1,7 +1,7 @@
 /*
- * Copyright 2017 - 2018 Anton Tananaev (anton@traccar.org)
+ * Copyright 2017 - 2019 Anton Tananaev (anton@traccar.org)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
@@ -47,11 +47,18 @@ public class SpotProtocolDecoder extends BaseHttpProtocolDecoder {
     private XPathExpression messageExpression;
 
     public SpotProtocolDecoder(Protocol protocol) {
         super(protocol);
         try {
-            documentBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+            DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
+            builderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            builderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            builderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+            builderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            builderFactory.setXIncludeAware(false);
+            builderFactory.setExpandEntityReferences(false);
+            documentBuilder = builderFactory.newDocumentBuilder();
             xPath = XPathFactory.newInstance().newXPath();
             messageExpression = xPath.compile("//messageList/message");
         } catch (ParserConfigurationException | XPathExpressionException e) {
             throw new RuntimeException(e);
         }

Vulnerable code:  * Copyright 2017 - 2018 Anton Tananaev (anton@traccar.org)
            documentBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
Fixed code:  * Copyright 2017 - 2019 Anton Tananaev (anton@traccar.org)
            DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
            builderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
            builderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
            builderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
            builderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
            builderFactory.setXIncludeAware(false);
            builderFactory.setExpandEntityReferences(false);
            documentBuilder = builderFactory.newDocumentBuilder();