XML input vulnerability based on DTD declaration [SPR-13136]

[spring-projects-issues]

Toshiaki Maki opened SPR-13136 and commented

If DTD is not entirely disabled, inline DTD declarations can be used to perform Denial of Service attacks known as XML bombs. Such declarations are both well-formed and valid according to XML schema rules but when parsed can cause out of memory errors. To protect against this kind of attack DTD support must be disabled by setting the disallow-doctype-dec feature in the DOM and SAX APIs to true and by setting the supportDTD property in the StAX API to false.

---

Issue Links:

• Disable DTD and external entities support in XmlEventDecoder to prevent XXE and XML bomb attack [SPR-15797] #20352 Disable DTD and external entities support in XmlEventDecoder to prevent XXE and XML bomb attack

Backported to: 3.2.14

0 votes, 5 watchers

[spring-projects-issues]

Rossen Stoyanchev commented

Reference to CVE report:
http://pivotal.io/security/cve-2015-3192.

[spring-projects-issues]

Rossen Stoyanchev commented

Please note that there are additional considerations besides the fixes for this issue when using StAX. The details are in the CVE report referenced above.