Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled

[Tim <tim-security () sentinelchicken org>]

Hi Tomas,

Thanks for looking into this.  Sorry for the slow reply. 


> As far as I can see setExpandEntityReferences() controls what value is
> set for the create-entity-ref-nodes DOM parser feature:
>
> http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/jaxp/DocumentBuilderImpl.java#l158
> http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/jaxp/DocumentBuilderImpl.java#l74
> http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/impl/Constants.java#l427
>
> The description in Java API docs is rather brief, xerces docs have more
> details:
>
> http://xerces.apache.org/xerces-j/features.html#create-entity-ref-nodes
> http://xerces.apache.org/xerces2-j/features.html#dom.create-entity-ref-nodes
>
> AFAICS, the feature does not aim to control if entity references are
> expanded, but only how exactly they appear in the resulting DOM tree.

Ok, that makes sense.  Of course it is pointless for security if it
doesn't affect parameter entities.  I also find it odd that one of the
only standard methods available to directly tweak entity behavior can
only be implemented by setting a feature in Xerces that is
non-standard.


> Maybe your paper should rather mention parser features as
> external-general-entities and external-parameter-entities:
>
> http://docs.oracle.com/javase/7/docs/api/org/xml/sax/package-summary.html#package_description

I do mention the specific features that one needs to disable in order
to make parsing safe.  However, I didn't realize that that some of
these features were standardized.  Still, it would be quite confusing
to any developer that doesn't spend extensive amounts of time
researching each XML feature and understanding what needs to be turned
off.


> OWASP XXE document covers some of this, but actually mentions only one
> of the two features...
>
> https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing#Java

I did end up releasing my paper recently, which I believe has
up-to-date recommendations for Xerces:
  http://vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf


Best,
tim