Skip to content

XXE漏洞 #889

New issue
New issue
Closed
Closed
XXE漏洞#889

Description

@QiAnXinCodeSafe
QiAnXinCodeSafe
opened on Dec 20, 2018

您好：
我是360代码卫士的工作人员，在我们的开源项目代码检测过程中发现weixin-java-tools项目存在XXE漏洞，详细信息如下：
在BaseWxPayResult.java文件的getXmlDoc方法中：
default
创建了xml解析器，但没有禁用外部实体就直接用于解析xml导致了xxe漏洞

此处是一个xxe盲注，做个简单的复现
在BaseWxPayResultTest.java对xmlStr做个修改
default
日志信息
default
还望及时修复

Activity

  1. binarywang commented on Dec 20, 2018

    @binarywang
    binarywang
    on Dec 20, 2018
    Owner

    多谢及时指出，近期准备修复

  2. binarywang
    added a commit that references this issue on Dec 20, 2018

    #889 修复一些潜在的XXE漏洞代码

    6272639

  3. binarywang commented on Dec 21, 2018

    @binarywang
    binarywang
    on Dec 21, 2018
    Owner

    3.2.10.B测试版本 已修复

  4. binarywang
    closed this as completedon Dec 21, 2018
  5. comeonc
    added 2 commits that reference this issue on Jan 2, 2019

    Merge branch 'develop' of github.com:Wechat-Group/weixin-java-tools i…

    f5fe09d

    Merge branch 'master' of github.com:Wechat-Group/weixin-java-tools in…

    622952c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions