Loading vulnerability…
XXE in OpenSAML Java ParserPool and Decrypter
CVE-2013-6440 is an XML External Entity vulnerability in Shibboleth OpenSAML-Java versions before 2.6.1. The default configurations of BasicParserPool and StaticBasicParserPool enable entity expansion, allowing parsing of attacker-controlled XML containing DOCTYPE declarations and external entity references. The XML Decrypter and SAML Decrypter internally create vulnerable parser pools; BaseMessageDecoder-derived decoders also use an insecure internal parser pool unless an application supplies one. This permits external-entity resolution and related XML information-disclosure and denial-of-service attacks.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker may cause the application server to resolve external entities. This can disclose files readable by the application-server account and can induce outbound requests to attacker-selected or internal resources, enabling advanced XXE scenarios such as network probing or access to otherwise unreachable services. Malicious entity constructs may also impose excessive CPU or memory consumption, resulting in denial of service.
If you can’t patch tonight, do this now.
For affected deployments not using the Decrypter implementations, explicitly supply a securely configured ParserPool. Disable entity expansion, enable secure XML processing, and disallow DOCTYPE declarations. On Xerces and Xerces-derived JAXP implementations, including common Oracle and OpenJDK runtimes, enable the Xerces DOCTYPE-disallow feature; use the equivalent implementation-specific setting for other JAXP parsers. Applications constructing BaseMessageDecoder-derived decoders must provide the secure ParserPool explicitly. When supplying a custom parser feature map, explicitly retain all secure features because it overrides OpenSAML default features.
Patch, then assume compromise.
Upgrade OpenSAML-Java to version 2.6.1 or later. This release changes ParserPool constructor defaults to resist these XML attacks and is the required remediation for applications using the affected Decrypter implementations, because OpenSAML 2.6.0 and earlier do not provide a way to configure or replace the parser pools created internally by those classes. Apply the corresponding supported vendor updates for products bundling the affected OpenSAML/XMLTooling components, then restart affected application-server processes where required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.