1

The explanation of CVE-2016-3720 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3720 is vague, but reading the code I found the following issues. Even after fixing the issues, the OWasp Dependency Check Tool still reports the jar file as vulnerable to the attack. I think it has a false positive after the fix has been applied.

CVE-2016-3720 exposes an XML Entity injection attack in the Jackson Library. https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing An XML Entity injection attack can create an infinite loop in the parsing of an XML file.
Which will ultimate eat up all the memory in an Application Server, or it can inject a reference to an external site (this is the issue reported).

Unfortunately the source code for the older version of Jackson is not available on Github, the project source versions only go back to the jackson-databind-2.0.0-RC1 level.

If you are using an older version of Spring, then you may not be able to upgrade to the newest version of Jackson 2.x, so now you have a security dilemma. How to fix the vulnerability, without upgrading Spring.

1

6 Answers 6

3

This is what you need to do:

Using a web based de-compiler ( www.javadecompilers.com ), you can get all the source code for the jar file jackson-all-1.9.11.jar . (This will work on any version of Jackson )

The fixes are fairly simple!

In the 1.9.x version the following 2 files allow XML entity injection.
org/codehaus/jackson/xc/DomElementJsonDeserializer.java
org/codehaus/jackson/map/ext/DOMDeserializer.java

When you update the jar be sure to update the additional nested inner classes.


org/codehaus/jackson/map/ext/DOMDeserializer.class
org/codehaus/jackson/map/ext/DOMDeserializer$DocumentDeserializer.class
org/codehaus/jackson/map/ext/DOMDeserializer$NodeDeserializer.class
org/codehaus/jackson/xc/DomElementJsonDeserializer.class



In the  2.x.x version the package name has changed.
These files need to be modified


com/fasterxml/jackson/databind/ext/DOMDeserializer.java
com/fasterxml/jackson/dataformat/xml/XmlFactory.java

The in the 1.9 version the solution to stop Entity injection is to add the following line to the two files.

.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);

Here is where to add it to the de-compiled code, then recompile the files, and update the jar files.

    public abstract class DOMDeserializer<T>
extends FromStringDeserializer<T> {
static final DocumentBuilderFactory _parserFactory;
static {
    _parserFactory = DocumentBuilderFactory.newInstance();

    /* CVE-2016-3720 */
    try {
        _parserFactory.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
    } catch (ParserConfigurationException e) {
        e.printStackTrace();
    }
    // Move this line from the static block lower in the file.
    _parserFactory.setNamespaceAware(true);

}

 public DomElementJsonDeserializer() {
    super(Element.class);
    try {
        DocumentBuilderFactory bf = DocumentBuilderFactory.newInstance();
        bf.setNamespaceAware(true);
        /* CVE-2016-3720 */ 
        bf.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);

        this.builder = bf.newDocumentBuilder();
    }
    catch (ParserConfigurationException e) {
        throw new RuntimeException();
    }
}

In the 2.x version, you need to modify this file slightly differently. Add the line:

xmlIn.setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.FALSE);


package com.fasterxml.jackson.dataformat.xml;

public class XmlFactory
extends JsonFactory {


   protected XmlFactory(ObjectCodec oc, int xpFeatures, int xgFeatures, XMLInputFactory xmlIn, XMLOutputFactory xmlOut, String nameForTextElem) {
    super(oc);
    this._xmlParserFeatures = xpFeatures;
    this._xmlGeneratorFeatures = xgFeatures;
    this._cfgNameForTextElement = nameForTextElem;
    if (xmlIn == null) {
        xmlIn = XMLInputFactory.newInstance();
        xmlIn.setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.FALSE);
    }

I hope you found this helpful.

2
2

The jackson 1 source code is available at https://github.com/FasterXML/jackson-1. I have created a pull request: https://github.com/FasterXML/jackson-1/pull/1

1
  • Cool. Thanks for raising the merge request. Its been merged into the repo long back.
    – vmorusu
    Apr 28 at 19:26
1

Even after fixing the issues, the OWasp Dependency Check Tool still reports the jar file as vulnerable to the attack. I think it has a false positive after the fix has been applied.

Note that OWASP DC doesn't scan the code. It uses evidence like the name of the JAR to associate it with data in the NVD, so if the name of the jar indicates a vulnerable version, it will identify it as vulnerable. When you have made a jar that you are asserting has the vulnerability addressed, you can use a suppression file with content like:

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://www.owasp.org/index.php/OWASP_Dependency_Check_Suppression">
  <suppress>
    <notes>There I fixed that</notes>
    <sha1>YOUR-JAR-SHA1-HERE</sha1>
    <cve>CVE-2016-3720</cve>
  </suppress>
</suppressions>

Note that if you are already using a suppression file, you just add the new <suppress> record to the existing file.

1
  • Did you try the jacksong-mapper-asl jar built from the master branch? If not try it. It is not getting reported as vulnerable. Master branch jar is versioned as 1.9.14.
    – vmorusu
    May 5 at 14:29
1

We can use this to solve vulnerable issue.

 repositories {
    maven {
      url "https://packages.atlassian.com/maven-3rdparty"
    }
  }

 implementation group: 'org.codehaus.jackson', name: 'jackson-mapper-asl', version: '1.9.14-atlassian-6'
0

One note on second part: instead of modifying source code, it is possible to pass explicitly instantiated XmlFactory(via XmlMapper). Constructor has been available since 2.4. This avoids having to manage modified jars.

0

If you are stuck with Jackson 1.9.13, instead of deserializing the JAR and packaging again, you can add the feature by reflection:

    static {
        mitigateCVE20163720Vulnerability();
    }

    @SneakyThrows
    static void mitigateCVE20163720Vulnerability() {
        var field = org.codehaus.jackson.map.ext.DOMDeserializer.class.getDeclaredField("_parserFactory");
        field.setAccessible(true);
        var documentBuilderFactory = (DocumentBuilderFactory) field.get(null);
        documentBuilderFactory.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
    }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.