|
| 1 | +# Summary of ESAPI Security Bulletins and GitHub Security Advisories</h1> |
| 2 | +This page attempts to summarize all the ESAPI Security Bulletins and GitHub Security Advisories in a table format. This started out as a lengthy email to the ESAPI User's Google group which you can find at |
| 3 | +"<a href="https://groups.google.com/a/owasp.org/g/esapi-project-users/c/_CR8d-dpvMU">A word about Log4J vulnerabilities in ESAPI - the TL;DR version</a>" |
| 4 | +but then morphed into this current format as more and more Log4J 1.x vulnerabilities were discovered as well as one in ESAPI itself that we felt compelled to detail. |
| 5 | + |
| 6 | +<table cellspacing="0" border="2"> |
| 7 | + <colgroup width="175"></colgroup> |
| 8 | + <colgroup width="265"></colgroup> |
| 9 | + <colgroup width="119"></colgroup> |
| 10 | + <colgroup width="199"></colgroup> |
| 11 | + <colgroup width="307"></colgroup> |
| 12 | + <colgroup width="450"></colgroup> |
| 13 | + <!-- Table heading row --> |
| 14 | + <tr> |
| 15 | + <td height="17" align="center"><b>Relevant ESAPI Security Bulletin / GitHub Security Advisory</b></td> |
| 16 | + <td align="center"><b>Summary</b></td> |
| 17 | + <td align="center"><b>Relevant CWEs</b></td> |
| 18 | + <td align="center"><b>Relevant Vuln ID</b></td> |
| 19 | + <td align="center"><b>Notes regarding potential impact</b></td> |
| 20 | + <td align="center"><b>ESAPI versions where default configuration is impacted</b></td> |
| 21 | + </tr> |
| 22 | + <tr> |
| 23 | + <td height="32" align="left"><a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin1.pdf">1</a></td> |
| 24 | + <td align="left">MAC bypass in ESAPI symmetric encryption</td> |
| 25 | + <td align="left"><a href="https://cwe.mitre.org/data/definitions/310.html">CWE-310</a></td> |
| 26 | + <td align="left"><a href="https://nvd.nist.gov/vuln/detail/CVE-2013-5679">CVE-2013-5679</a></td> |
| 27 | + <td align="left"><a class="comment-indicator"></a> |
| 28 | + MAC check may be bypassed thus not assuring the authenticity of the received ciphertext.</td> |
| 29 | + <td align="left">ESAPI 2.x versions before 2.1.0</td> |
| 30 | + </tr> |
| 31 | + <tr> |
| 32 | + <td height="62" align="left"><a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin2.pdf">2</a></td> |
| 33 | + <td align="left">Java deserialization vulnerability in Log4J 1 (via SocketServer) for ESAPI logging may lead to code injection</td> |
| 34 | + <td align="left"><a href="https://cwe.mitre.org/data/definitions/502.html">CWE-502</a></td> |
| 35 | + <td align="left"><a href="https://nvd.nist.gov/vuln/detail/CVE-2019-17571">CVE-2019-17571</a></td> |
| 36 | + <td align="left">SocketServer is a class presumably intended for aggregating Log4J log events. It is a server-side class. ESAPI does not use it, nor any Log4J 1 classes that use it.</td> |
| 37 | + <td align="left">None.<br>ESAPI 2.x versions 2.2.1.0 and later default to use JUL (java.util.logging)</td> |
| 38 | + </tr> |
| 39 | + <tr> |
| 40 | + <td height="77" align="left"><a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin3.pdf">3</a></td> |
| 41 | + <td align="left">This flaw allows a specially-crafted XML file to manipulate the validation process in processed by Xerces’ XMLSchemaValidation class in certain cases.</td> |
| 42 | + <td align="left"><a href="https://cwe.mitre.org/data/definitions/20.html">CWE-20</a></td> |
| 43 | + <td align="left"><a href="https://security.snyk.io/vuln/SNYK-JAVA-XERCES-608891">SNYK-JAVA-XERCES-608891</a> (related to <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-14621">CVE-2020-14621</a>)</td> |
| 44 | + <td align="left">An analysis of the ESAPI and Xerces code shows that ESAPI does not use the vulnerable Xerces class either directly or indirectly.</td> |
| 45 | + <td align="left">None, but fixed even with respect to SCA tools for ESAPI 2.2.3.0 and later which AntiSamy 1.6.2, which uses Xerces 2.12.1, where this vulnerability is fixed.</td> |
| 46 | + </tr> |
| 47 | + <tr> |
| 48 | + <td height="62" align="left"><a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin4.pdf">4</a></td> |
| 49 | + <td align="left">SMTPS (SMTP over SSL/TLS) can allow MITM attack if SMTPAppender is used with Log4J 1 ESAPI logging.</td> |
| 50 | + <td align="left"><a href="https://cwe.mitre.org/data/definitions/295.html">CWE-295</a></td> |
| 51 | + <td align="left"><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-9488">CVE-2020-9488</a></td> |
| 52 | + <td align="left">If you are using Log4J 1’s SMTPAppender in your code, you already have a direct dependency that makes it exploitable. ESAPI does nothing to cause or prevent that.</td> |
| 53 | + <td align="left">None. ESAPI uses ConsoleAppender as the default appender even if ESAPI logging is configured to use Log4J 1.</td> |
| 54 | + </tr> |
| 55 | + <tr> |
| 56 | + <td height="122" align="left"><a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin5.pdf">5</a></td> |
| 57 | + <td align="left">Invoking the method Commons IO method, FileNameUtils.normalize() with an improper input string could allow a limited path traversal.</td> |
| 58 | + <td align="left"><a href="https://cwe.mitre.org/data/definitions/22.html">CWE-22</a></td> |
| 59 | + <td align="left"><a href="https://nvd.nist.gov/vuln/detail/CVE-2021-29425">CVE-2021-29425</a></td> |
| 60 | + <td align="left">Commons IO is being pulled in via AntiSamy, which pulls in Apache Batik-CSS. Batik-CSS is part of a larger Apache Xmlgraphics Batik family.<br><br>Nothing in the Batik family of libraries uses org.apache.commons.io.FileNameUtils and neither ESAPI nor AntiSamy use Commons IO directly. Thus ESAPI is not affected by this CVE.</td> |
| 61 | + <td align="left">None. However may still show up in SCA output as AntiSamy using latest Apache Commons IO library version (2.6) that still support Java 7. AntiSamy 1.7 and later will require Java 8 as will ESAPI versions after 2.3.</td> |
| 62 | + </tr> |
| 63 | + <tr> |
| 64 | + <td height="115" align="left"><a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin6.pdf">6</a></td> |
| 65 | + <td align="left">Flaw in Log4J 1’s JSMAppender could cause insecure deserialization potentially leading to remote code execution.</td> |
| 66 | + <td align="left"><a href="https://cwe.mitre.org/data/definitions/502.html">CWE-502</a></td> |
| 67 | + <td align="left"><a href="https://nvd.nist.gov/vuln/detail/CVE-2021-4104">CVE-2021-4104</a></td> |
| 68 | + <td align="left">All versions of ESAPI are vulnerable and impacted if your application is doing all 3 of the following:<br>1) Using the deprecated ESAPI Log4J logging.<br>2) You have changed your default log4j.xml (or log4j.properties) file to use JMSAppender.<br>3) An attacker is able to overwrite the contents of your Log4J 1 configuration file.</td> |
| 69 | + <td align="left">None. ESAPI uses ConsoleAppender as the default appender even if ESAPI logging is configured to use Log4J 1.</td> |
| 70 | + </tr> |
| 71 | + <tr> |
| 72 | + <td height="115" align="left"><a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin7.pdf">7</a></td> |
| 73 | + <td align="left">Improper validation (or, specifically, not using parameterized SQL queries) of a SQL statement makes Apache Log4j JDBCAppender vulnerable to SQL Injection. This potentially could allow attackers to execute unintended SQL statements by entering data that is logged via Log4J 1.</td> |
| 74 | + <td align="left"><a href="https://cwe.mitre.org/data/definitions/89.html">CWE-89</a></td> |
| 75 | + <td align="left"><a href="https://nvd.nist.gov/vuln/detail/CVE-2022-23305">CVE-2022-23305</a></td> |
| 76 | + <td align="left">All versions of ESAPI are vulnerable and impacted if your application is doing both of the following:<br>1) Using the deprecated ESAPI Log4J logging.<br>2) You have changed your default log4j.xml (or log4j.properties) file to use JDBCAppender.</td> |
| 77 | + <td align="left">None. ESAPI uses ConsoleAppender as the default appender even if ESAPI logging is configured to use Log4J 1.</td> |
| 78 | + </tr> |
| 79 | + <tr> |
| 80 | + <td height="92" align="left"><a class="comment-indicator"></a> |
| 81 | + <a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf">8</a> |
| 82 | + <br/> |
| 83 | + <a href="https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-q77q-vx4q-xx6q">GHSA-q77q-vx4q-xx6q</a> |
| 84 | + </td> |
| 85 | + <td align="left">Improper sanitization of user-controlled input permitted by an incorrect regular expression in an ESAPI configuration file can result in that input being unintentionally executing javascript: URLs, resulting in Cross-Site Scripting (XSS).</td> |
| 86 | + <td align="left"><a href="https://cwe.mitre.org/data/definitions/79.html">CWE-79</a></td> |
| 87 | + <td align="left"><a href="https://nvd.nist.gov/vuln/detail/CVE-2022-24891">CVE-2022-24891</a></td> |
| 88 | + <td align="left"> |
| 89 | + A malformed regular expression in ESAPI’s default AntiSamy policy file, |
| 90 | + “antisamy-esapi.xml”, accidentally allowed the “:” character to match as a part |
| 91 | + of the “onsiteURL” regular expression. This allowed |
| 92 | + 'javascript:' pseudo-URIs to slip past ESAPI which could result in |
| 93 | + XSS vulnerabilities. Note that this vulnerability dates |
| 94 | + back at least to the ESAPI 1.4 release. |
| 95 | + </td> |
| 96 | + <td align="left">ESAPI 1.4 and all ESAPI 2.x versions before 2.3.0.0.</td> |
| 97 | + </tr> |
| 98 | + <tr> |
| 99 | + <td height="100" align="left"> |
| 100 | + <a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin9.pdf">9</a> |
| 101 | + </td> |
| 102 | + <td align="left"> |
| 103 | + Apache Log4j 1’s JMSSink is vulnerable to insecure deserialization of |
| 104 | + untrusted logged data when the attacker has write access to the |
| 105 | + Log4j configuration or if the configuration references an LDAP service |
| 106 | + that the attacker has access to. This may resulting in remote code |
| 107 | + execution. |
| 108 | + </td> |
| 109 | + <td align="left"><a href="https://cwe.mitre.org/data/definitions/502.html">CWE-502</a></td> |
| 110 | + <td align="left"><a href="https://nvd.nist.gov/vuln/detail/CVE-2022-23302">CVE-2022-23302</a></td> |
| 111 | + <td align="left"> |
| 112 | + Remote Code Execution is possible. |
| 113 | + </td> |
| 114 | + <td align="left"> |
| 115 | + None. ESAPI uses ConsoleAppender as the default appender even if ESAPI logging is configured to use Log4J 1. |
| 116 | + </td> |
| 117 | + </tr> |
| 118 | + |
| 119 | + <tr> |
| 120 | + <td height="115" align="left"> |
| 121 | + <a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin10.pdf">10</a> |
| 122 | + </td> |
| 123 | + <td align="left"> |
| 124 | + There is an RCE flaw caused by an insecure deserialization |
| 125 | + vulnerability in Apache Chainsaw, a Java-based GUI log viewer. |
| 126 | + CVE-2020-9493 identified a deserialization issue that was present in |
| 127 | + Apache Chainsaw 2.x prior to 2.1.0. However, prior to Chainsaw V2.0, |
| 128 | + Chainsaw was a component of Apache Log4j 1.2.x where the same |
| 129 | + issue exists and remains unfixed. |
| 130 | + </td> |
| 131 | + <td align="left"> |
| 132 | + <a href="https://cwe.mitre.org/data/definitions/502.html">CWE-502</a> |
| 133 | + </td> |
| 134 | + <td align="left"> |
| 135 | + <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-23307">CVE-2022-23307</a> |
| 136 | + </td> |
| 137 | + <td align="left"> |
| 138 | + Remote Code Execution is possible if you are running Apache Chainsaw 1.x from the Apache Log4J 1.2.x jar.. |
| 139 | + </td> |
| 140 | + <td align="left"> |
| 141 | + None. ESAPI uses ConsoleAppender as the default appender even if ESAPI logging is configured to use Log4J 1. |
| 142 | + </td> |
| 143 | + </tr> |
| 144 | + |
| 145 | + <tr> |
| 146 | + <td height="115" align="left"> |
| 147 | + <a href="https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-8m5h-hrqm-pxm2">GHSA-8m5h-hrqm-pxm2</a> |
| 148 | + </td> |
| 149 | + <td align="left"> |
| 150 | + The default implementation of Validator.getValidDirectoryPath(String, String, File, boolean) |
| 151 | + may incorrectly treat the tested input string as a child of the specified parent directory. This |
| 152 | + potentially could allow control-flow bypass checks to be defeated if an attack can specify |
| 153 | + the entire string representing the 'input' path. |
| 154 | + </td> |
| 155 | + <td align="left"> |
| 156 | + <a href="https://cwe.mitre.org/data/definitions/22.html">CWE-22</a> |
| 157 | + </td> |
| 158 | + <td align="left"> |
| 159 | + <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-23457">CVE-2022-23457</a> |
| 160 | + </td> |
| 161 | + <td align="left"> |
| 162 | + Control-flow bypass may be possible. |
| 163 | + </td> |
| 164 | + <td align="left"> |
| 165 | + ESAPI 2.x, prior to the ESAPI 2.3.0.0 release. Version 2.3.0.0 and later are patched. |
| 166 | + </td> |
| 167 | + </tr> |
| 168 | + |
| 169 | +</table> |
0 commit comments