XML External Entity injection in JBoss Enterprise Application Platform

1) XML External Entity injection

EUVDB-ID: #VU38972

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-7503

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.

Mitigation

Install update from vendor's website.

Vulnerable software versions

JBoss Enterprise Application Platform: 7.0.5

CPE2.3

• cpe:2.3:a:red_hat:jboss_enterprise_application_platform:7.0.5:*:*:*:*:*:*:*

External links

https://www.securityfocus.com/bid/98546
https://bugzilla.redhat.com/show_bug.cgi?id=1451960

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.