API Validation XML Schemas do not forbid file system access (XXE)

[brianwrf]

Version

• vert.x web: <= 3.5.3

Context

Just found a potential XXE vulnerability in vertx-web as show below, it seems function isValid didn't add any protection from XXE vulnerability when parsing XML document.

https://github.com/vert-x3/vertx-web/blob/3.5.3/vertx-web-api-contract/src/main/java/io/vertx/ext/web/api/validation/impl/XMLTypeValidator.java#L34

Mitigation

Follow the OWASP guide below which provides concise information to prevent this vulnerability. https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#Java

[brianwrf]

@pmlopes Thanks for the fast fix. Is there a CVE announcement on this issue?

Cheers,
Brian

[vietj]

@brianwrf there might be one indeed

[brianwrf]

@vietj Thanks for your response. Can you kindly please keep me updated if the CVE announcement is ready?

[vietj]

it will be part of the 3.5.4 release notes, so just watch this

[pmlopes]

Note

This issue is not affected by user/application input, but only by badly crafted application configuration. Users using the api contracts module with the default settings are not affected, only if explicitly enabled the XML validation and provided a malicious XSD as input.

[brianwrf]

@vietj @pmlopes Thanks for the confirmation.

[vietj]

This has been identified as CVE-2018-12544 - the CVE has not yet been fulfilled at the moment of writing this but it will be soon