Red Hat Bugzilla – Bug 1451960
CVE-2017-7503 EAP: XXE issue in TransformerFactory
Last modified: 2018-01-30 20:23:45 EST
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.
Created wildfly tracking bugs for this issue:
Affects: fedora-all [bug 1451961]
Name: Jason Shepherd (Red Hat Product Security), Katerina Novotna (Red Hat Quality Engineering)
It will be difficult to fix this issue in Xerces. The patch which contains the fix in OpenJDK contains many other related changes. It appears to be fixed in revision 292:7b89fed7212b of the jaxp repo, http://hg.openjdk.java.net/jdk8/jdk8/jaxp/
An alternative might be to remove Xerces from EAP. However it will be difficult to remove and still maintain support for IBM JDK, see https://issues.jboss.org/browse/WFCORE-2805?focusedCommentId=13447139&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13447139
This issue affects processing of XML content from an untrusted source using a javax.xml.transform.TransformerFactory. The only safe way to process untrusted XML content with a TransformerFactory is to use the StAX API. StAX is a safe implementation on EAP 7.0.x because the XML content is not read in it's entirety in order to parse it. As a developer using StAX, you decide which XML stream events you want to react to, so XXE control constructs won't be processed automatically by the parser.