CVE-2014-0107: Medium severity Apache Xalan-Java vulnerability
Apache Xalan-Java could allow a remote attacker to bypass security restrictions, caused by the improper handling of output properties. An attacker could exploit this vulnerability to bypass the secure processing feature to load arbitrary restricted classes.
Other sources
It was found that the Xalan-Java secure processing feature imposes insufficient constraints:
Java properties, bound to XSLT 1.0 system-property(), are accessible.
Output properties that allow to load arbitrary classes or resources are allowed.
Arbitrary code can be executed if the Bean Scripting Framework (BSF) is in the classpath, as it allows to spawn available JARs with secure processing disabled, effectively bypassing the intended protection.
A remote attacker who is able to provide XSL that will be processed by Xalan-Java could use this flaw to bypass the constraints of the secure processing feature. Depending on the components available on the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java.
— Red Hat
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURESECUREPROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/xalan-j2to a version that resolves this vulnerability.Fixed in 2.7.2 - Upgrade
Upgrade
maven/xalan:xalanto a version that resolves this vulnerability.Fixed in 2.7.2 - Upgrade
Upgrade
Apache Xalan-Javato a version that resolves this vulnerability.Fixed in 2.7.2 - Configuration
Ensure FEATURE_SECURE_PROCESSING is enabled in Apache Xalan-Java TransformerFactory; note that in Apache Xalan-Java before 2.7.2 this feature does not properly restrict access to certain properties, allowing bypass via xalan:content-header, xalan:entities, xslt:content-header, xslt:entities, or a Java property bound via XSLT 1.0 system-property().
Apache Xalan-Java TransformerFactory FEATURE_SECURE_PROCESSING = enabled
Event History
Frequently Asked Questions
What is the vulnerability in Apache Xalan-Java?
The vulnerability in Apache Xalan-Java is CVE-2014-0107.
How does CVE-2014-0107 impact Apache Xalan-Java?
CVE-2014-0107 can allow a remote attacker to bypass security restrictions and load arbitrary classes or access external resources.
What is the severity of CVE-2014-0107?
The severity of CVE-2014-0107 is high with a CVSS score of 7.
How can I fix the vulnerability in Apache Xalan-Java CVE-2014-0107?
To fix CVE-2014-0107, update your Apache Xalan-Java installation to version 2.7.2 or above.
Where can I find more information about CVE-2014-0107?
You can find more information about CVE-2014-0107 in the following references: [Link 1](https://issues.apache.org/jira/browse/XALANJ-2435), [Link 2](http://svn.apache.org/viewvc?view=revision&revision=1581058), [Link 3](http://www.ocert.org/advisories/ocert-2014-002.html).