Bypass of the secureValidation property

Vulnerability

The vulnerability in Apache Santuario – XML Security for Java affects all versions prior to 2.2.3 and 2.1.7. The bug is that the secureValidation property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This oversight allows an attacker to embed a RetrievalMethod element that uses an XPath Transform, and due to the missing security validation, the XPath transform can be abused to extract arbitrary local .xml files [1].

Exploitation

The attacker requires the ability to supply a crafted XML signature or encryption document that includes a KeyInfoReference pointing to a malicious RetrievalMethod. The attacker does not need authentication or special privileges beyond being able to send the malformed input to an application using Apache Santuario. By using an XPath Transform in the RetrievalMethod, the attacker can read any .xml file on the local filesystem [1].

Impact

Successful exploitation leads to local file disclosure (information disclosure) of .xml files. The attacker can read sensitive XML configuration files, keystores, or other XML data that the application process has access to. The CIA impact is limited to confidentiality Loss; no direct code execution or privilege escalation is described in the available references [1].

Mitigation

Users should upgrade to Apache Santuario – XML Security for Java version 2.2.3 or 2.1.7, which contain the fix. The fix ensures that secureValidation is properly enforced when handling KeyInfoReference elements. No workaround is available in the references [1].