XXE injection in Apache Axis2/Java via WSDL
Apache Axis2/Java lets clients build AxisService from a WSDL URL, so wsdl4j parses imported WSDL and XSD documents containing DOCTYPE and external entities. An attacker controlling the WSDL or any imported document can read local files or force the JVM to make network requests. This affects users of versions through 2.0.1; upgrade to 2.0.2 fixes it.
What to do: Upgrade to Apache Axis2/Java 2.0.2. No workaround given.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Axis2/Java | through 2.0.1 | 2.0.2 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read local files or make the JVM issue network requests. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
The XML External Entity (XXE) injection vulnerability in Apache Axis2/Java allows attackers to inject external entities when clients import WSDL/XSD documents via wsdl4j.
Today 1.5K readers · 2.4K views · 768 reads · all time 189K views