CVE-2009-3960

CVE-2009-3960: Adobe BlazeDS XML External Entity Information Disclosure

AI-generated analysis based on the vulnerability data on this page.

Summary

Adobe BlazeDS 3.2 and earlier versions contain an unspecified vulnerability involving injected tags and external entity references in XML documents. The flaw allows remote, unauthenticated attackers to obtain sensitive information from systems running affected Adobe products.

Background

BlazeDS is a remoting and messaging technology used to connect Adobe Flex and AIR applications with back-end services. It is bundled with multiple Adobe enterprise platforms including ColdFusion, Adobe LiveCycle, and Flex Data Services. In early 2010, Adobe released security bulletin APSB10-05 to address this vulnerability across the affected product lines.

Root Cause

The official CWE identifier is not recorded in NVD. However, the vulnerability description explicitly references "injected tags and external entity references in XML documents," which is characteristic of an XML External Entity (XXE) processing flaw (CWE-611). The issue stems from the BlazeDS XML parser resolving external entities within user-supplied XML payloads, allowing attackers to read local files or perform server-side request forgery.

Impact

• CVSS v2 Score: 4.3 (MEDIUM) — Network exploitable with medium complexity; no authentication required. Confidentiality impact is Partial.
• CVSS v3 Score: 6.5 (MEDIUM) — Network attack with low complexity, no privileges required, but user interaction is required. Confidentiality impact is High.
• Availability / Integrity: No impact on integrity or availability per the official vector.
• EPSS: 0.90012 (90.01% probability of exploitation), placing it in the 99.78th percentile, indicating extremely high real-world exploit likelihood.
• Known Exploited Vulnerability (KEV): Yes — added to the CISA KEV catalog on 2022-03-07, confirming active exploitation in the wild.

Exploitation Walkthrough

Ethics Notice: The following description is provided for defensive awareness only. Do not use this information to attack systems without explicit authorization. Unauthorized access to computer systems is illegal in most jurisdictions.

An attacker crafts a malicious XML document containing external entity references and submits it to a BlazeDS endpoint (for example, via an AMF remoting gateway or message destination that accepts XML). If the parser resolves the external entity, the attacker can coerce the server to read arbitrary local files or make outbound requests. The resulting data may be reflected in error messages, responses, or application logs.

Defenders should test their BlazeDS endpoints for XXE by:

1. Submitting benign XML payloads with defined internal entities to verify parsing behavior.
2. Monitoring server logs for unexpected outbound connections or file-read events.
3. Reviewing XML parser configurations for external entity resolution settings.

Affected and Patched Versions

Affected products and versions:

• Adobe BlazeDS 3.2 and earlier
• Adobe ColdFusion 7.0.2, 8.0, 8.0.1, 9.0
• Adobe Flex Data Services 2.0.1
• Adobe LiveCycle 8.0.1, 8.2.1, 9.0
• Adobe LiveCycle Data Services 2.5.1, 2.6.1, 3.0

Patches: Adobe released security bulletin APSB10-05 with patches for all affected products. Administrators should apply the vendor-provided updates for their specific product and version.

Remediation

1. Patch: Apply the updates from Adobe Security Bulletin APSB10-05 for the affected product.
2. Disable External Entities: If patching is not immediately feasible, configure the underlying XML parser to disable external entity resolution and DTD processing.
3. Network Segmentation: Restrict BlazeDS endpoints to authorized clients only; do not expose remoting interfaces to untrusted networks.
4. Input Validation: Implement strict validation on all XML inputs; reject documents containing DTD declarations or external entity references where possible.
5. WAF / IDS: Deploy web-application firewall rules that detect XML payloads containing DTDs or entity expansion patterns.

Detection

• Monitor application logs for unusual XML parsing errors or unexpected file-read operations.
• Alert on outbound network connections from BlazeDS application servers to unexpected destinations.
• Use file-integrity monitoring to detect unauthorized modifications to BlazeDS configuration files.
• Review HTTP request logs for large XML payloads or requests containing DOCTYPE declarations.

Assessment

Despite the moderate CVSS scores, the EPSS of 0.90012 and CISA KEV listing make this a high-priority remediation item. The gap between the CVSS v2 score (4.3) and the actual threat level illustrates a classic limitation of older scoring models: information-disclosure vulnerabilities with low complexity can be trivially weaponized and are frequently exploited in the wild.

Key lessons:

1. CVSS alone does not capture exploitation prevalence; always pair with EPSS and KEV data.
2. XXE vulnerabilities in middleware (like BlazeDS) have a broad blast radius because they affect every application built on that platform.

References

• http://secunia.com/advisories/38543
• http://securitytracker.com/id?1023584
• http://www.adobe.com/support/security/bulletins/apsb10-05.html
• http://www.osvdb.org/62292
• http://www.securityfocus.com/bid/38197
• https://www.exploit-db.com/exploits/41855/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3960