PT-2017-9015 · Apache · Apache Sling

Bertrand Delacretaz · Publicado 2017-07-19 · Atualizado 2022-05-17 · CVE-2016-6798

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Sling versions prior to 1.0.12

Description The issue concerns the XSS Protection API module in Apache Sling, where the method XSS.getValidXML() uses an insecure SAX parser to validate input strings. This allows for XXE attacks in scripts that use this method for user input validation, potentially enabling an attacker to read sensitive filesystem data, perform same-site request forgery (SSRF), conduct port scanning behind firewalls, or cause a denial-of-service (DoS) condition.

Recommendations For versions prior to 1.0.12, update to version 1.0.12 or later to resolve the issue. As a temporary workaround, consider disabling the XSS.getValidXML() method until a patch is available. Restrict access to sensitive data and limit the application's ability to make external requests to minimize the risk of exploitation.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2016-6798

GHSA-7G54-VGP6-JJ5W

Produtos afetados

Apache Sling

Referências · 8

• 🔥 https://github.com/jensdietrich/xshady-release/tree/main/CVE-2016-6798 · Exploit
• https://github.com/apache/sling-org-apache-sling-xss/commit/de32b144ad2be3367559f6184d560db42a220529 · Nota
• http://securityfocus.com/bid/99873 · Nota
• https://lists.apache.org/thread.html/b72c3a511592ec70729b3ec2d29302b6ce87bbeab62d4745617a6bd0%40%3Cdev.sling.apache.org%3E · Nota
• https://lists.apache.org/thread.html/b72c3a511592ec70729b3ec2d29302b6ce87bbeab62d4745617a6bd0@%3Cdev.sling.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6798 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-6798 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7g54-vgp6-jj5w · Aviso do Fabricante