Re: [CVE-2020-11991] Apache Cocoon security vulnerability

[Cédric Damioli]

Hi,

Entities resolution is managed by features of the SAX Parser, before any 
transformation.

Cédric

Le 11/09/2020 à 12:12, gelo1234 a écrit :

Hello Cedric,

Are external entities blocked also in XSLT?

Greetings,
Greg

pt., 11 wrz 2020 o 11:39 Cédric Damioli <cdami...@apache.org 
<mailto:cdami...@apache.org>> napisał(a):

    [CVE-2020-11991] Apache Cocoon security vulnerability

    Severity: Important

    Vendor: The Apache Software Foundation

    Versions Affected: Apache Cocoon up to 2.1.12

    Description: When using the StreamGenerator, the code parse a
    user-provided XML.

    A specially crafted XML, including external system entities, could
    be used to access any file on the server system.

    Mitigation:

    The StreamGenerator now ignores external entities. 2.1.x users
    should upgrade to 2.1.13

    Example:

    With the following input :

    <!--?xml version="1.0" ?--> <!DOCTYPE replace [<!ENTITY ent SYSTEM
    "file:///etc/shadow"> ]> <userInfo> <firstName>John</firstName>
    <lastName>&ent;</lastName> </userInfo> an attacker got the content
    of /etc/shadow

    Credit: This issue was discovered by Nassim Asrir.


    Regards,

    -- 
    Cédric Damioli


--
Cédric Damioli
CMS - Java - Open Source
www.ametys.org