Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0049051Openbravo ERPA. Platformpublic2022-04-12 12:272022-04-26 14:27
Reporterfermin_ostivar 
Assigned ToAugustoMauch 
PriorityimmediateSeveritycriticalReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Versionpi 
Target VersionPR22Q2Fixed in VersionPR22Q2 
Merge Request Status
Review Assigned To
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0049051: XML parsers XXE attacks vulnerabilty
DescriptionWe have detected a SaxParser vulnerable to XXE attach in the class TranslationManager

      final SAXParserFactory factory = SAXParserFactory.newInstance();
      final SAXParser parser = factory.newSAXParser();
      parser.parse(in, handler);


https://gitlab.com/openbravo/product/openbravo/-/blob/master/src/org/openbravo/erpCommon/ad_forms/TranslationManager.java#L641 [^]
https://gitlab.com/openbravo/product/openbravo/-/blob/master/src/org/openbravo/erpCommon/ad_forms/TranslationManager.java#L666 [^]
Steps To ReproduceN/A
Proposed SolutionTo create a new get method in the class XMLUtil.java as newSAXReader and to call it in the lines reported previously
Additional Information
TagsNo tags attached.
Relationships
blocks design defect 0049039 closed AugustoMauch XML parsers XXE attacks vulnerabilty 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2022-04-13 13:24AugustoMauchTypedesign defect => backport
2022-04-13 13:24AugustoMauchTarget Version => PR22Q2
2022-04-25 17:01hgbotNote Added: 0136725
2022-04-26 14:27hgbotResolutionopen => fixed
2022-04-26 14:27hgbotStatusscheduled => closed
2022-04-26 14:27hgbotFixed in Version => PR22Q2
2022-04-26 14:27hgbotNote Added: 0136757
2022-04-26 14:27hgbotNote Added: 0136758

Notes
(0136725)
hgbot   
2022-04-25 17:01   
Merge Request created: https://gitlab.com/openbravo/product/openbravo/-/merge_requests/567 [^]
(0136757)
hgbot   
2022-04-26 14:27   
Directly closing issue as related merge request is already approved.

Repository: https://gitlab.com/openbravo/product/openbravo [^]
Changeset: ebb6bd67ecc712e0e31fb39243cf935ead8088d0
Author: Augusto Mauch <augusto.mauch@openbravo.com>
Date: 26-04-2022 11:36:15
URL: https://gitlab.com/openbravo/product/openbravo/-/commit/ebb6bd67ecc712e0e31fb39243cf935ead8088d0 [^]

Fixes ISSUE-49051: Provides a safe way to create instances of SAXParser

A new method has been created in XMLUtil to create instances of SAXParser that are not vulnerable to XXE attacks

---
M src/org/openbravo/dal/xml/XMLUtil.java
M src/org/openbravo/erpCommon/ad_forms/TranslationManager.java
---
(0136758)
hgbot   
2022-04-26 14:27   
Merge request merged: https://gitlab.com/openbravo/product/openbravo/-/merge_requests/567 [^]