PRao202011 (Community Member) asked a question.

November 7, 2019 at 5:59 AM
Veracode showing CWE-611 Improper Restriction of XML External Entity Reference

Veracode static scan showing two flows as CWE 611 XXE vulnerability in the app. We are doing Java xml parsing using DocumentBuilderFactory and xslt tranfformation using TransformerFactory.

 

I have set the Features according to OWASP/CheatSheetSeries for DocumentBuilderFactory as below:

 

DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();

documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);

documentBuilderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

documentBuilderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);

 

And also for TransformerFactory as below:

 

TransformerFactory tf = TransformerFactory.newInstance();

tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");

tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

 

But still it is showing in static scan. Need help on this

  • 4 answers
  • 8.64K views

  • Boy, Security Consultant (Veracode)

    Hi @PRao202011 (Community Member)​ ,

     

    Veracode Static Analysis supports the remediation advice from the OWASP CheatSheet ( https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html ) and it will attempt to detect correct remediation of CWE 611 and automatically close the flaw.

    It may however, not always be able to pick it up, especially if it is implemented in another method than the method doing the XML parsing.

    We recommend moving the remediation to the method doing the XML parsing to have Veracode Static Analysis be able to detect it and automatically close the flaw or you can consider proposing a mitigation and contacting your security team to have it reviewed. For more information on how to propose a mitigation please see: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ .

     

    Thank you,

    Boy Baukema

    Expand Post
    Selected as Best

    • PRao202011 (Community Member)

      Thank you Boy for quick response. It is working if i move the remediation to parsing method.

  • André (Community Member)

    Our Java based application does XML parsing in a lot of places so we decided to create an internal API returning a secure document builder factory. So setting the secure feature occurs in just one place ideally. But this place is obviously NOT the method doing the actual XML parsing.

     

    My takeaway from the discussion above is that in our case, Veracode static scan will not detect the correct remediation and we will have a mitigated flaw forever... Right?

    Expand Post

    • Boy, Security Consultant (Veracode)

      Hi @André (Community Member)​ ,

       

      Veracode Static Analysis should be able to detect remediation within the method or 1 method call away (for example a call to a static XMLUtilities.createSecureDocumentBuilderFactory() ). If however you have more indirection we may not be able to automatically detect even correct remediation and you should propose a mitigation and have this mitigation reviewed by your security team.

       

      Thank you,

      Boy Baukema

      Expand Post

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.