CVE-2015-0227: Apache WSS4J improper access control via wrapping attacks

CVE-2015-0227 · Severity: medium · Published 2022-05-14

Apache WSS4J is a library used to secure Java-based web services. A vulnerability in how it handles security headers allows attackers to bypass requirements for signed or encrypted data. This could allow an unauthorized person to send malicious messages that the system incorrectly trusts, potentially leading to unauthorized access or data manipulation.

Technologies: org.apache.ws.security:wss4j (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2015-0227 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2015-0227 being exploited in the wild.
How severe is CVE-2015-0227?
Medium severity, published 14 May 2022.
Which products and versions are affected?
Apache Software Foundation WSS4J < 1.6.17, >= 2.0.0, < 2.0.2; org.apache.ws.security:wss4j (Maven) ECOSYSTEM:introduced=0,fixed=1.6.17; wss4j:wss4j (Maven) ECOSYSTEM:introduced=0,fixed=1.6.17.
Is there a fix for CVE-2015-0227?
Yes. org.apache.ws.security:wss4j (Maven): upgrade to 1.6.17 or later; wss4j:wss4j (Maven): upgrade to 1.6.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-0227 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2015-0227?
Check whether you run Apache Software Foundation WSS4J, org.apache.ws.security:wss4j (Maven) or wss4j:wss4j (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.ws.security:wss4j (Maven): upgrade to 1.6.17 or later
    # set org.apache.ws.security:wss4j to 1.6.17 in your pom.xml or build.gradle
  • wss4j:wss4j (Maven): upgrade to 1.6.17 or later
    # set wss4j:wss4j to 1.6.17 in your pom.xml or build.gradle

Technical details

Apache WSS4J is susceptible to XML Signature Wrapping (XSW) attacks. The vulnerability exists because the library incorrectly validates security constraints when the 'requireSignedEncryptedDataElements' configuration is enabled. A remote, unauthenticated attacker can exploit this by manipulating the XML structure of a SOAP message to include unauthorized elements that bypass signature or encryption checks. This allows the attacker to perform actions with the privileges of a trusted sender. The issue is resolved in versions 1.6.17 and 2.0.2.

Affected products

  • Apache WSS4J < 1.6.17, >= 2.0.0, < 2.0.2

Identifiers

  • CVE-2015-0227
  • GHSA-6r5v-hp32-fjqw

Timeline

  • 2015-02-12: disclosed
  • 2015-02-12: advisory
  • 2022-05-14: other: Advisory published to GitHub database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.