Executive brief
Castor is a popular Java data-binding framework used to convert Java objects to and from XML. A vulnerability in its default configuration allows attackers to submit specially crafted XML files that can trick the system into reading sensitive local files or performing unauthorized network requests. This could lead to the exposure of internal configuration data or credentials stored on the server.
Technical details
Castor, a Java data-binding framework, is vulnerable to XML External Entity (XXE) injection (CWE-611) due to an insecure default configuration of its underlying Xerces SAX Parser. By submitting a malicious XML document containing external entity references, an unauthenticated attacker can potentially read local files, perform Server-Side Request Forgery (SSRF), or cause a denial-of-service condition. The vulnerability exists because the parser does not restrict the resolution of external entities by default. This issue is resolved in Castor version 1.3.3 by updating the parser configuration to disable external entity processing.
Affected products
- codehaus castor < 1.3.3
- castor castor <= 1.0
Timeline
- 2014-05-14: disclosed: Full disclosure on seclists.org
- 2014-06-11: advisory: NVD published CVE-2014-3004
- 2022-05-13: advisory: GitHub Advisory published
References
- https://api.github.com/users/AndrzejBiernacki2010
- https://github.com/AndrzejBiernacki2010
- https://api.github.com/users/AndrzejBiernacki2010/gists%7B/gist_id%7D
- https://api.github.com/users/AndrzejBiernacki2010/repos
- https://avatars.githubusercontent.com/u/124769069?v=4
- https://api.github.com/users/AndrzejBiernacki2010/events%7B/privacy%7D