Loading vulnerability…
XXE and XSLT Extension RCE in Apache Standard Taglibs
CVE-2015-0254 is an XML external entity (XXE) vulnerability in Apache Standard Taglibs before version 1.2.3, affecting JSTL XML processing through the <x:parse> and <x:transform> tags. When an application supplies attacker-controlled or otherwise untrusted XML to these tags, the XML/XSLT processor can resolve external entity references and process crafted XSLT extensions. This permits access to resources available to the application host and may enable arbitrary code execution through XSLT extension mechanisms.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker able to cause vulnerable JSTL XML processing of crafted input can read or otherwise access host-accessible resources through external entities. Crafted XSLT extensions may further permit arbitrary code execution with the permissions of the affected application. Consequences can include disclosure of sensitive application or system data, modification of data, service disruption, and compromise of the application server.
If you can’t patch tonight, do this now.
Do not process untrusted input with JSTL <x:parse> or <x:transform> tags. Restrict or disable external entity resolution and external DTD/schema access in the XML and XSLT processor. Disable or tightly constrain XSLT extension functions, validate XML and stylesheet inputs against an allowlist, and prevent attacker control over XML, stylesheets, and referenced resources. On affected older Java environments, configure the Apache Taglibs external-entity access control property to deny external access; affected EAP deployments can set the corresponding property to false at server startup.
Patch, then assume compromise.
Upgrade Apache Standard Taglibs, including the relevant JSTL implementation dependency, to version 1.2.3 or later. The fixed release enables JAXP secure-processing protections that restrict unsafe XML processing. Apply the applicable vendor updates for products that bundle the vulnerable library, including supported JBoss EAP or other application-server distributions, and restart the application server after updating where required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.