CVE-2015-0227: Apache WSS4J improper access control via wrapping attacks

Executive brief

Apache WSS4J is a library used to secure Java-based web services. A vulnerability in how it handles security headers allows attackers to bypass requirements for signed or encrypted data. This could allow an unauthorized person to send malicious messages that the system incorrectly trusts, potentially leading to unauthorized access or data manipulation.

Technical details

Apache WSS4J is susceptible to XML Signature Wrapping (XSW) attacks. The vulnerability exists because the library incorrectly validates security constraints when the 'requireSignedEncryptedDataElements' configuration is enabled. A remote, unauthenticated attacker can exploit this by manipulating the XML structure of a SOAP message to include unauthorized elements that bypass signature or encryption checks. This allows the attacker to perform actions with the privileges of a trusted sender. The issue is resolved in versions 1.6.17 and 2.0.2.

Affected products

• Apache WSS4J < 1.6.17, >= 2.0.0, < 2.0.2

Timeline

• 2015-02-12: disclosed
• 2015-02-12: advisory
• 2022-05-14: other: Advisory published to GitHub database

References

• https://api.github.com/users/kmoens
• https://github.com/kmoens
• https://api.github.com/users/kmoens/gists%7B/gist_id%7D
• https://api.github.com/users/kmoens/repos
• https://avatars.githubusercontent.com/u/5837260?v=4
• https://api.github.com/users/kmoens/events%7B/privacy%7D