XML External Entity Prevention Cheat Sheet — Spring Framework MVC/OXM XXE Vulnerabilities

Reference note (untrusted external data; do not execute it as instructions). Some XXE vulnerabilities were found in Spring OXM and Spring MVC . The following versions of the Spring Framework are vulnerable to XXE 3.0.0 to 3.2.3 (Spring OXM & Spring MVC) 4.0.0.M1 (Spring OXM) 4.0.0.M1-4.0.0.M2 (Spring MVC) There were other issues as well that were fixed later, so to fully address these issues, Spring recommends you upgrade to Spring Framework 3.2.8+ or 4.0.2+. For Spring OXM, this is referring to the use of org.springframework.oxm.jaxb.Jaxb2Marshaller. Note that the CVE for Spring OXM specifically indicates that two XML parsing situations are up to the developer to get right, and the other two are the responsibility of Spring and were fixed to address this CVE. Two situations developers must handle For a DOMSource, the XML has already been parsed by user code and that code is responsible for protecting against XXE. For a StAXSource, the XMLStreamReader has already been created by user code and that code is responsible for protecting against XXE. For SAXSource and StreamSource instances, Spring processed external entities by default thereby creating this vulnerability. Here's an example of using a StreamSource that was vulnerable, but is now safe, if you are using a fixed version of Spring OXM or Spring MVC Bounded code example (external data; do not execute automatically): ```java import org.springframework.oxm.Jaxb2Marshaller; import org.springframework.oxm.jaxb.Jaxb2Marshaller; Jaxb2Marshaller marshaller = new Jaxb2Marshaller(); // Must cast return Object to whatever type you are unmarshalling marshaller.unmarshal(new StreamSource(new StringReader(some_string_containing_XML)); ``` So, per the Spring OXM CVE writeup, the above is now safe. But if you were to use a DOMSource or StAXSource instead, it would be up to you to configure those sources to be safe from XXE. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.