CVE-2019-12400

Vulnerability

Analysis

CVE-2019-12400 is a security flaw in Apache Santuario XML Security for Java versions 2.0.3 through 2.0.x and all 2.1.x releases prior to 2.1.4. The vulnerability arises from a caching mechanism introduced to improve performance; the library uses a static pool of DocumentBuilders to speed up XML document creation. However, an attacker who can register a malicious DocumentBuilder implementation with the thread context class loader before Santuario initializes its cache may cause the library to cache and reuse that rogue implementation [4].

Exploitation

Exploitation requires that untrusted code can execute prior to Santuario's first use of the DocumentBuilder pool, typically in environments like application servers where multiple components share a JVM. If the attacker can load a malicious class via the context class loader, the cached builder will be used for subsequent XML signature verification or document processing, potentially bypassing security checks [1][2][3].

Impact

Successful exploitation could allow an attacker to subvert XML Signature validation, leading to forged or altered signed documents being accepted as authentic. The impact is primarily on the integrity and trustworthiness of XML-based signatures within affected applications [4].

Mitigation

Apache Santuario has fixed this issue in version 2.1.4. Users of affected releases should upgrade to 2.1.4 or a later version. Red Hat has also released patched packages in RHSA-2020:0804, RHSA-2020:0805, RHSA-2020:0806 for Red Hat JBoss Enterprise Application Platform [1][2][3].