VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Mar 12, 2013· Updated Apr 29, 2026

CVE-2013-0239

CVE-2013-0239

Description

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.cxf:cxf-rt-frontend-jaxrsMaven
< 2.5.92.5.9
org.apache.cxf:cxf-rt-frontend-jaxrsMaven
>= 2.6.0, < 2.6.62.6.6
org.apache.cxf:cxf-rt-frontend-jaxrsMaven
>= 2.7.0, < 2.7.32.7.3

Affected products

26
  • Apache/Cxf26 versions
    cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*+ 25 more
    • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*range: <=2.5.8
    • cpe:2.3:a:apache:cxf:2.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:*

Patches

1
e4c6b3b0899e

[CXF-4776] - Fix + re-enable tests

https://github.com/apache/cxfColm O HeigeartaighJan 25, 2013via ghsa
commit
3 files changed · +53 −4
  • rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/UsernameTokenPolicyValidator.java+28 −1 modified
    @@ -29,6 +29,8 @@
 import org.apache.cxf.ws.policy.AssertionInfo;
 import org.apache.cxf.ws.policy.AssertionInfoMap;
 import org.apache.cxf.ws.security.policy.SP12Constants;
+import org.apache.cxf.ws.security.policy.SPConstants;
+import org.apache.cxf.ws.security.policy.model.SupportingToken;
 import org.apache.ws.security.WSConstants;
 import org.apache.ws.security.WSSecurityEngineResult;
 import org.apache.ws.security.message.token.UsernameToken;
@@ -94,10 +96,15 @@ public boolean checkTokens(
                 ai.setNotAsserted("Password hashing policy not enforced");
                 return false;
             }
-            if (usernameTokenPolicy.isNoPassword() && usernameToken.getPassword() != null) {
+            if (usernameTokenPolicy.isNoPassword() && (usernameToken.getPassword() != null)) {
                 ai.setNotAsserted("Username Token NoPassword policy not enforced");
                 return false;
+            } else if (!usernameTokenPolicy.isNoPassword() && (usernameToken.getPassword() == null)
+                && isNonEndorsingSupportingToken(usernameTokenPolicy)) {
+                ai.setNotAsserted("Username Token No Password supplied");
+                return false;
             }
+            
             if (usernameTokenPolicy.isRequireCreated() 
                 && (usernameToken.getCreated() == null || usernameToken.isHashed())) {
                 ai.setNotAsserted("Username Token Created policy not enforced");
@@ -112,4 +119,24 @@ public boolean checkTokens(
         return true;
     }
     
+    /**
+     * Return true if this UsernameToken policy is a (non-endorsing)SupportingToken. If this is
+     * true then the corresponding UsernameToken must have a password element.
+     */
+    private boolean isNonEndorsingSupportingToken(
+        org.apache.cxf.ws.security.policy.model.UsernameToken usernameTokenPolicy
+    ) {
+        SupportingToken supportingToken = usernameTokenPolicy.getSupportingToken();
+        if (supportingToken != null) {
+            SPConstants.SupportTokenType type = supportingToken.getTokenType();
+            if (type == SPConstants.SupportTokenType.SUPPORTING_TOKEN_SUPPORTING
+                || type == SPConstants.SupportTokenType.SUPPORTING_TOKEN_SIGNED
+                || type == SPConstants.SupportTokenType.SUPPORTING_TOKEN_SIGNED_ENCRYPTED
+                || type == SPConstants.SupportTokenType.SUPPORTING_TOKEN_ENCRYPTED) {
+                return true;
+            }
+        }
+        return false;
+    }
+    
 }
  • rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/UsernameTokenInterceptor.java+25 −1 modified
    @@ -55,6 +55,7 @@
 import org.apache.cxf.ws.security.SecurityConstants;
 import org.apache.cxf.ws.security.policy.SP12Constants;
 import org.apache.cxf.ws.security.policy.SPConstants;
+import org.apache.cxf.ws.security.policy.model.SupportingToken;
 import org.apache.cxf.ws.security.policy.model.UsernameToken;
 import org.apache.ws.security.WSConstants;
 import org.apache.ws.security.WSDocInfo;
@@ -263,8 +264,11 @@ private UsernameToken assertUsernameTokens(SoapMessage message, WSUsernameTokenP
             tok = (UsernameToken)ai.getAssertion();
             if (princ != null && tok.isHashPassword() != princ.isPasswordDigest()) {
                 ai.setNotAsserted("Password hashing policy not enforced");
+            } else if (princ != null && !tok.isNoPassword() && (princ.getPassword() == null)
+                && isNonEndorsingSupportingToken(tok)) {
+                ai.setNotAsserted("Username Token No Password supplied");
             } else {
-                ai.setAsserted(true);                
+                ai.setAsserted(true);         
             }
         }
         ais = aim.getAssertionInfo(SP12Constants.SUPPORTING_TOKENS);
@@ -277,6 +281,26 @@ private UsernameToken assertUsernameTokens(SoapMessage message, WSUsernameTokenP
         }
         return tok;
     }
+    
+    /**
+     * Return true if this UsernameToken policy is a (non-endorsing)SupportingToken. If this is
+     * true then the corresponding UsernameToken must have a password element.
+     */
+    private boolean isNonEndorsingSupportingToken(
+        org.apache.cxf.ws.security.policy.model.UsernameToken usernameTokenPolicy
+    ) {
+        SupportingToken supportingToken = usernameTokenPolicy.getSupportingToken();
+        if (supportingToken != null) {
+            SPConstants.SupportTokenType type = supportingToken.getTokenType();
+            if (type == SPConstants.SupportTokenType.SUPPORTING_TOKEN_SUPPORTING
+                || type == SPConstants.SupportTokenType.SUPPORTING_TOKEN_SIGNED
+                || type == SPConstants.SupportTokenType.SUPPORTING_TOKEN_SIGNED_ENCRYPTED
+                || type == SPConstants.SupportTokenType.SUPPORTING_TOKEN_ENCRYPTED) {
+                return true;
+            }
+        }
+        return false;
+    }
 
     private void addUsernameToken(SoapMessage message) {
         UsernameToken tok = assertUsernameTokens(message, null);
  • systests/ws-security/src/test/java/org/apache/cxf/systest/ws/policy/JavaFirstPolicyServiceTest.java+0 −2 modified
    @@ -71,7 +71,6 @@ public static void cleanup() throws Exception {
     }
     
     @org.junit.Test
-    @org.junit.Ignore
     public void testUsernameTokenInterceptorNoPasswordValidation() {
         ClassPathXmlApplicationContext ctx = 
             new ClassPathXmlApplicationContext("org/apache/cxf/systest/ws/policy/client/javafirstclient.xml");
@@ -109,7 +108,6 @@ public void testUsernameTokenInterceptorNoPasswordValidation() {
     }
     
     @org.junit.Test
-    @org.junit.Ignore
     public void testUsernameTokenPolicyValidatorNoPasswordValidation() {
         ClassPathXmlApplicationContext ctx = 
             new ClassPathXmlApplicationContext("org/apache/cxf/systest/ws/policy/client/javafirstclient.xml");

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

25

News mentions

0

No linked articles in our index yet.