How to Apply the Patch for Security Vulnerability CVE-2013-3925/CVE-2012-2926
Platform Notice: Data Center - This article applies to Atlassian products on the Data Center platform.
Note that this knowledge base article was created for the Data Center version of the product. Data Center knowledge base articles for non-Data Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Description
This issue has been assigned CVE-2013-3925 by Mitre Corporation.
The previously reported issue CVE-2012-2926 (August 2012, CVSS score 6.4) was patched by introducing a new XFire servlet component into Crowd. The new component disables external entity resolution during XML parsing.
The new component has been configured to work for URLs with pattern /crowd/services/ but does not intercept calls to /crowd/services/2/ (etc).
The work for this issue has been tracked in CWD-3366 - Parsing of external XML entities can be exploited to retrieve files or make HTTP requests on the target network
Applying the Patch
The fix requires replacing the xfire-servlet.xml file in the crowd-server jar. The patched version of the file can be used with Crowd 2.3.7, 2.4.1 and above, or any 2.5 or 2.6 release. See xfire-servlet.xml attached to this issue.
For example, for Crowd 2.4.2:
We need to replace the current xfire-servlet.xml file from crowd-server-2.4.2.jar with the new xfire-servlet.xml. Here's how:
- Download xfire-servlet.xml to this location:
<your-crowd-install>/atlassian-crowd-2.4.2/crowd-webapp/WEB-INF/lib/ Replace the old file with the new one. One way to do it without having to open the jar, replace the file, and recreate the jar is to perform the command below:
zip -u <your-crowd-install>/atlassian-crowd-2.4.2/crowd-webapp/WEB-INF/lib/crowd-server-2.4.2.jar xfire-servlet.xmlRestart Crowd
For older versions of Crowd:
You can manually edit the relevant jar file to remove the urlMap entries.
For Crowd 2.1.2 or 2.2.9, unzip the file crowd-server-*.*.*.jar file, e.g.:
jar xvf atlassian-crowd-2.1.2/crowd-webapp/WEB-INF/lib/crowd-server-2.1.2.jar -C temp/Manually edit the xfire-servlet.xml to remove all urlMap entries other than the first key="/*" entry:
<bean class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping"> <property name="urlMap"> <map> <entry key="/*" value-ref="securityServerService"/> - <entry key="/1/*" value-ref="securityServerService"/> - <entry key="/2/*" value-ref="securityServerService2"/> - <entry key="/latest/*" value-ref="securityServerService2"/> </map> </property> </bean>Save the file and recreate the jar, e.g.:
jar atlassian-crowd-2.1.2/crowd-webapp/WEB-INF/lib/crowd-server-2.1.2.jar temp/- Restart Crowd