CVE-2014-0107 Improper Authorization in Apache Xalan-Java

High 7.5 Published 15 Apr 2014 Updated 6 Aug 2024

Remote attackers can bypass security restrictions in Apache Xalan-Java to load arbitrary classes or access external resources via crafted XSLT properties.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-0107?

CVE-2014-0107 is a high-severity vulnerability in Oracle Webcenter Sites, published on 15 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Weakness: CWE-264

Which versions are affected by CVE-2014-0107?

2 open source packages ship an affected version, including xalan:xalan. It affects 2 products.

Package	Affected	Fixed in
`xalan:xalan` Maven	All versions	`2.7.2`
`xalan:xalan` Maven	All versions	`2.7.2`

Linux distribution packages (38)

`xalan-j2` Red Hat:enterprise_linux:5::client	All versions	`0:2.7.0-6jpp.2`
`xalan-j2-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:2.7.0-6jpp.2`
`xalan-j2-manual` Red Hat:enterprise_linux:5::client	All versions	`0:2.7.0-6jpp.2`
`xalan-j2-xsltc` Red Hat:enterprise_linux:5::client	All versions	`0:2.7.0-6jpp.2`
`xalan-j2` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:2.7.0-6jpp.2`
`xalan-j2-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:2.7.0-6jpp.2`
`xalan-j2-demo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:2.7.0-6jpp.2`
`xalan-j2-javadoc` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:2.7.0-6jpp.2`
`xalan-j2` Red Hat:enterprise_linux:5::server	All versions	`0:2.7.0-6jpp.2`
`xalan-j2-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:2.7.0-6jpp.2`
`xalan-j2-demo` Red Hat:enterprise_linux:5::server	All versions	`0:2.7.0-6jpp.2`
`xalan-j2-javadoc` Red Hat:enterprise_linux:5::server	All versions	`0:2.7.0-6jpp.2`
`xalan-j2-manual` Red Hat:enterprise_linux:5::server	All versions	`0:2.7.0-6jpp.2`
`xalan-j2-xsltc` Red Hat:enterprise_linux:5::server	All versions	`0:2.7.0-6jpp.2`
`xalan-j2` Red Hat:enterprise_linux:6::client	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-demo` Red Hat:enterprise_linux:6::client	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-javadoc` Red Hat:enterprise_linux:6::client	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-manual` Red Hat:enterprise_linux:6::client	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-xsltc` Red Hat:enterprise_linux:6::client	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-demo` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-javadoc` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-manual` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-xsltc` Red Hat:enterprise_linux:6::computenode	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2` Red Hat:enterprise_linux:6::server	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-demo` Red Hat:enterprise_linux:6::server	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-javadoc` Red Hat:enterprise_linux:6::server	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-manual` Red Hat:enterprise_linux:6::server	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-xsltc` Red Hat:enterprise_linux:6::server	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-demo` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-javadoc` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-manual` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2-xsltc` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.7.0-9.9.el6_5`
`xalan-j2` Red Hat:jboss_enterprise_application_platform:5::el4	All versions	`0:2.7.1-12_patch_08.ep5.el4`
`xalan-j2` Red Hat:jboss_enterprise_application_platform:5::el5	All versions	`0:2.7.1-12_patch_08.ep5.el5`
`xalan-j2` Red Hat:jboss_enterprise_application_platform:5::el6	All versions	`0:2.7.1-12_patch_08.ep5.el6`
`xalan-j2-eap6` Red Hat:jboss_enterprise_application_platform:6::el5	All versions	`0:2.7.1-9.redhat_7.1.ep6.el5`

Products include Apache Xalan-Java, Oracle Webcenter Sites.

How do I fix CVE-2014-0107?

Upgrade xalan:xalan to 2.7.2 or later.

Is CVE-2014-0107 being exploited?

There is no known exploitation of CVE-2014-0107 in the wild and no public exploit code.

CVE-2022-34169 Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets High 7.5

All Oracle Webcenter Sites vulnerabilities

Sources

Also known as DEBIAN-CVE-2014-0107, DSA-2886-1, GHSA-rc2w-r4jq-7pfx, MGASA-2014-0152, RHSA-2014:0348, RHSA-2014:0453 and 2 more.