security.snyk.io Open in urlscan Pro
2600:1408:c400:158f::ecd  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Developer Tools
 * Snyk Learn
 * Snyk Advisor
 * Code Checker

About Snyk
 1. Snyk Vulnerability Database
 2. Maven
 3. org.owasp.esapi:esapi




XML EXTERNAL ENTITY (XXE) INJECTION AFFECTING ORG.OWASP.ESAPI:ESAPI PACKAGE,
VERSIONS [0,2.2.3.0)

--------------------------------------------------------------------------------

SEVERITY

Recommended
3.0
low
0
10

CVSS ASSESSMENT MADE BY SNYK'S SECURITY TEAM

Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components
are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about XML External Entity (XXE) Injection vulnerabilities in an
interactive lesson.

Start learning
 * Snyk ID SNYK-JAVA-ORGOWASPESAPI-1088594
 * published 26 Mar 2021
 * disclosed 23 Mar 2021
 * credit Dave Wichers

Report a new vulnerability Found a mistake?

INTRODUCED: 23 MAR 2021

CVE NOT AVAILABLE CWE-611 Open this link in a new tab

Share



HOW TO FIX?

Upgrade org.owasp.esapi:esapi to version 2.2.3.0 or higher.


OVERVIEW

org.owasp.esapi:esapi is an OWASP project to create simple strong security
controls for every web platform.

Affected versions of this package are vulnerable to XML External Entity (XXE)
Injection via alteration of local ESAPI configuration and loading XML version of
the ESAPI properties file.


DETAILS

XXE Injection is a type of attack against an application that parses XML input.
XML is a markup language that defines a set of rules for encoding documents in a
format that is both human-readable and machine-readable. By default, many XML
processors allow specification of an external entity, a URI that is dereferenced
and evaluated during XML processing. When an XML document is being parsed, the
parser can make a request and include the content at the specified URI inside of
the XML document.

Attacks can include disclosing local files, which may contain sensitive data
such as passwords or private user data, using file: schemes or relative paths in
the system identifier.

For example, below is a sample XML document, containing an XML element-
username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>


An external XML entity - xxe, is defined using a system identifier and present
within a DOCTYPE header. These entities can access local or remote content. For
example the below code contains an external XML entity that would fetch the
content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>


Other XXE Injection attacks can access local resources that may not stop
returning data, possibly impacting application availability and leading to
Denial of Service.


REFERENCES

 * GitHub Issue
 * GitHub PR


CVSS SCORES

version 3.1
Expand this section


SNYK

3 low
 * Attack Vector (AV)
   Local
 * Attack Complexity (AC)
   High
 * Privileges Required (PR)
   High
 * User Interaction (UI)
   None

 * Scope (S)
   Unchanged

 * Confidentiality (C)
   Low
 * Integrity (I)
   Low
 * Availability (A)
   None


PRODUCT

 * Snyk Open Source
 * Snyk Code
 * Snyk Container
 * Snyk Infrastructure as Code
 * Test with Github
 * Test with CLI


RESOURCES

 * Vulnerability DB
 * Documentation
 * Disclosed Vulnerabilities
 * Blog
 * FAQs


COMPANY

 * About
 * Jobs
 * Contact
 * Policies
 * Do Not Sell My Personal Information


CONTACT US

 * Support
 * Report a new vuln
 * Press Kit
 * Events


FIND US ONLINE

 * 
 * 
 * 
 * 


TRACK OUR DEVELOPMENT

 * 
 * 



© 2024 Snyk Limited

Registered in England and Wales. Company number: 09677925

Registered address: Highlands House, Basingstoke Road, Spencers Wood, Reading,
Berkshire, RG7 1NT.