PT-2017-9015 · Apache · Apache Sling

Bertrand Delacretaz · Published 2017-07-19 · Updated 2022-05-17 · CVE-2016-6798

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Sling versions prior to 1.0.12

Description The issue concerns the XSS Protection API module in Apache Sling, where the method XSS.getValidXML() uses an insecure SAX parser to validate input strings. This allows for XXE attacks in scripts that use this method for user input validation, potentially enabling an attacker to read sensitive filesystem data, perform same-site request forgery (SSRF), conduct port scanning behind firewalls, or cause a denial-of-service (DoS) condition.

Recommendations For versions prior to 1.0.12, update to version 1.0.12 or later to resolve the issue. As a temporary workaround, consider disabling the XSS.getValidXML() method until a patch is available. Restrict access to sensitive data and limit the application's ability to make external requests to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2016-6798

GHSA-7G54-VGP6-JJ5W

Affected Products

Apache Sling

References · 8

• 🔥 https://github.com/jensdietrich/xshady-release/tree/main/CVE-2016-6798 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-6798 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6798 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7g54-vgp6-jj5w · Vendor Advisory
• https://github.com/apache/sling-org-apache-sling-xss/commit/de32b144ad2be3367559f6184d560db42a220529 · Note
• http://securityfocus.com/bid/99873 · Note
• https://lists.apache.org/thread.html/b72c3a511592ec70729b3ec2d29302b6ce87bbeab62d4745617a6bd0%40%3Cdev.sling.apache.org%3E · Note
• https://lists.apache.org/thread.html/b72c3a511592ec70729b3ec2d29302b6ce87bbeab62d4745617a6bd0@%3Cdev.sling.apache.org%3E · Note