CVE-2020-36640 (Java, published 2023-01-05T10:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/bonitasoft/bonita-connector-webservice
Files changed:
src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java
Commit message: fix(vulnerabilities): fix XXE attacks vulnerabilities and other code smell (#17)

* Access to external entities and network access should always be
disable to avoid XXS attacks vulnerabilities.
* Log error properly
* refactor logger name to be compliant with java naming conventions

Vulnerable code:
    private final Logger LOGGER = Logger.getLogger(this.getClass().getName());
    @SuppressWarnings("unchecked")
        LOGGER.info(SERVICE_NS + " " + serviceNS);
        LOGGER.info(SERVICE_NAME + " " + serviceName);
        LOGGER.info(PORT_NAME + " " + portName);
        LOGGER.info(BINDING + " " + binding);
        LOGGER.info(ENDPOINT_ADDRESS + " " + endpointAddress);
            LOGGER.info(USER_NAME + " " + authUserName);
            LOGGER.info(PASSWORD + " ********");
        LOGGER.info(SOAP_ACTION + " " + soapAction);
            LOGGER.warning("Invalid XML characters have been detected in the envelope, they will be removed.");
        LOGGER.info(ENVELOPE + " " + sanitizedEnvelope);
        LOGGER.info(BUILD_RESPONSE_DOCUMENT_ENVELOPE + " " + buildResponseDocumentEnvelope);
        LOGGER.info(BUILD_RESPONSE_DOCUMENT_BODY + " " + buildResponseDocumentBody);
        LOGGER.info(PRINT_REQUEST_AND_RESPONSE + " " + printRequestAndResponse);
        LOGGER.info(PROXY_HOST + " " + host);
        LOGGER.info(PROXY_PROTOCOL + " " + protocol);
        LOGGER.info(PROXY_PORT + " " + port);
            LOGGER.info("Setting environment variable: socksProxyHost=" + host);
            LOGGER.info("Setting environment variable: socksProxyPort=" + port);
            LOGGER.info("Setting environment variable: " + hostKey + "=" + host);
            LOGGER.info("Setting environment variable: " + portKey + "=" + port);
        LOGGER.info(PROXY_USER + " " + user);
        LOGGER.info(PROXY_PASSWORD + " ********");
                responseDocumentBody = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument();
            e.printStackTrace();
            transformer = TransformerFactory.newInstance().newTransformer();

Fixed code:
import javax.xml.XMLConstants;
    private final Logger logger = Logger.getLogger(this.getClass().getName());
        logger.info(SERVICE_NS + " " + serviceNS);
        logger.info(SERVICE_NAME + " " + serviceName);
        logger.info(PORT_NAME + " " + portName);
        logger.info(BINDING + " " + binding);
        logger.info(ENDPOINT_ADDRESS + " " + endpointAddress);
            logger.info(USER_NAME + " " + authUserName);
            logger.info(PASSWORD + " ********");
        logger.info(SOAP_ACTION + " " + soapAction);
            logger.warning("Invalid XML characters have been detected in the envelope, they will be removed.");
        logger.info(ENVELOPE + " " + sanitizedEnvelope);
        logger.info(BUILD_RESPONSE_DOCUMENT_ENVELOPE + " " + buildResponseDocumentEnvelope);
        logger.info(BUILD_RESPONSE_DOCUMENT_BODY + " " + buildResponseDocumentBody);
        logger.info(PRINT_REQUEST_AND_RESPONSE + " " + printRequestAndResponse);
        logger.info(PROXY_HOST + " " + host);
        logger.info(PROXY_PROTOCOL + " " + protocol);
        logger.info(PROXY_PORT + " " + port);
            logger.info("Setting environment variable: socksProxyHost=" + host);
            logger.info("Setting environment variable: socksProxyPort=" + port);
            logger.info("Setting environment variable: " + hostKey + "=" + host);
            logger.info("Setting environment variable: " + portKey + "=" + port);
        logger.info(PROXY_USER + " " + user);
        logger.info(PROXY_PASSWORD + " ********");
                DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
                documentBuilderFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
                documentBuilderFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
                responseDocumentBody = documentBuilderFactory.newDocumentBuilder().newDocument();
            logger.severe(e.getMessage());
            TransformerFactory transformerFactory = TransformerFactory.newInstance();
            transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
            transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
            transformer = transformerFactory.newTransformer();