CVE-2013-6448 (published 2014-01-23T00:55Z)

The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allows remote attackers to bypass the WebRemote annotation restriction and obtain information about arbitrary classes and methods on the server classpath via unspecified vectors.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/seam2/jboss-seam
commit_details: repo_url: https://github.com/seam2/jboss-seam
author: manaRH
author_date: 2014-01-21 14:47:52+00:00
msg: https://issues.jboss.org/browse/WFK2-375 enhanced fix

git-svn-id: https://svn.jboss.org/repos/seam/branches/enterprise/WFK-2_1@15651 a9c07ecc-ef43-0410-a306-c911db474e88
repository: repo_url: https://github.com/seam2/jboss-seam
repo_name: seam2/jboss-seam
description: http://www.seamframework.org/Seam2 - Seam 2: enterprise Java development framework
repo_language: Java
owner: seam2
file_changes: filename: ExecutionHandler.java
change_type: ModificationType.MODIFY
diff: @@ -21,6 +21,7 @@ import org.jboss.seam.log.LogProvider;
 import org.jboss.seam.log.Logging;
 import org.jboss.seam.remoting.wrapper.Wrapper;
 import org.jboss.seam.servlet.ContextualHttpServletRequest;
+import org.jboss.seam.util.XML;
 
 /**
  * Unmarshals the calls from an HttpServletRequest, executes them in order and
@@ -67,7 +68,7 @@ public class ExecutionHandler extends BaseRequestHandler implements RequestHandl
       log.debug("Processing remote request: " + requestData);
       
       // Parse the incoming request as XML
-      SAXReader xmlReader = new SAXReader();
+      SAXReader xmlReader = XML.getSafeSaxReader();
       Document doc = xmlReader.read( new StringReader(requestData) );
       final Element env = doc.getRootElement();
       final RequestContext ctx = unmarshalContext(env);

programming_language: Java
filename: InterfaceGenerator.java
change_type: ModificationType.MODIFY
diff: @@ -88,16 +88,8 @@ public class InterfaceGenerator extends BaseRequestHandler implements RequestHan
               Component component = Component.forName(componentName);
               if (component == null)
               {                 
-                 try
-                 {
-                    Class c = Reflections.classForName(componentName);
-                    appendClassSource(response.getOutputStream(), c, types);
-                 }
-                 catch (ClassNotFoundException ex)
-                 {
-                    log.error(String.format("Component not found: [%s]", componentName));
-                    throw new ServletException("Invalid request - component not found.");
-                 }
+                 log.error(String.format("Component not found: [%s]", componentName));
+                 throw new ServletException("Invalid request - component not found.");
               }
               else
               {

programming_language: Java
filename: PollHandler.java
change_type: ModificationType.MODIFY
diff: @@ -21,6 +21,7 @@ import org.jboss.seam.remoting.messaging.PollError;
 import org.jboss.seam.remoting.messaging.PollRequest;
 import org.jboss.seam.remoting.wrapper.Wrapper;
 import org.jboss.seam.servlet.ContextualHttpServletRequest;
+import org.jboss.seam.util.XML;
 
 /**
  * Handles JMS Message poll requests.
@@ -56,7 +57,7 @@ public class PollHandler extends BaseRequestHandler implements RequestHandler
     response.setContentType("text/xml");
 
     // Parse the incoming request as XML
-    SAXReader xmlReader = new SAXReader();
+    SAXReader xmlReader = XML.getSafeSaxReader();
     Document doc = xmlReader.read(request.getInputStream());
     Element env = doc.getRootElement();
 

programming_language: Java
filename: SubscriptionHandler.java
change_type: ModificationType.MODIFY
diff: @@ -17,6 +17,7 @@ import org.jboss.seam.core.Manager;
 import org.jboss.seam.remoting.messaging.RemoteSubscriber;
 import org.jboss.seam.remoting.messaging.SubscriptionRegistry;
 import org.jboss.seam.remoting.messaging.SubscriptionRequest;
+import org.jboss.seam.util.XML;
 import org.jboss.seam.web.ServletContexts;
 
 /**
@@ -40,7 +41,7 @@ public class SubscriptionHandler extends BaseRequestHandler implements RequestHa
     response.setContentType("text/xml");
 
     // Parse the incoming request as XML
-    SAXReader xmlReader = new SAXReader();
+    SAXReader xmlReader = XML.getSafeSaxReader();
     Document doc = xmlReader.read(request.getInputStream());
     Element env = doc.getRootElement();
 

programming_language: Java
filename: XML.java
change_type: ModificationType.MODIFY
diff: @@ -65,4 +65,17 @@ public class XML
        }
 
    }
+   
+   /**
+    * Get safe SaxReader with doctype feature disabled 
+    * @see http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl 
+    * @return
+    * @throws Exception
+    */
+   public static SAXReader getSafeSaxReader() throws Exception
+   {
+      SAXReader xmlReader = new SAXReader();
+      xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+      return xmlReader;
+   }
 }

programming_language: Java