Granite Data Services AMF framework fails to properly parse XML input containing a reference to external entities
Original Release date: 24 Mar 2016 | Last revised: 24 Mar 2016

Overview
Granite Data Services version 3.1.1-SNAPSHOT AMF framework is vulnerable to XML external entity (XXE) attack that may be leveraged to expose sensitive data on the host..

Description

CWE-611 – Improper Restriction of XML External Entity Reference (‘XXE’) – CVE-2016-2340Granite Data Services provides event driven, cross-framework application that can be found on Github (https://github.com/graniteds/graniteds).

Granite Data Services (http://www.graniteds.org/) provides server and client libraries that can be used to connect desktop and mobile applications to a server using the Action Message Format (AMF3) or Java Media Framework (JMF) serialization protocols.Granite Data Services version 3.1.1-SNAPSHOT AMF framework is vulnerable to a XML external entity (XXE) attack.

A XXE attacks how an application parses XML input.
If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.

Impact

A vulnerable server would allow a remote user access to sensitive data or cause a denial of service.

Solution

The CERT/CC is currently unaware of a practical solution to this problem.

Vendor Information (Learn More)
No information available.
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)
Group
Score
Vector
Base
4.3
AV:L/AC:L/Au:S/C:P/I:P/A:P
Temporal
3.5
E:POC/RL:ND/RC:UC
Environmental
1.4
CDP:LM/TD:L/CR:M/IR:M/AR:M

References

Credit
Thanks to Travis Emmert for reporting this vulnerability.
This document was written by Kyle O’Meara.

Other Information
CVE IDs: CVE-2016-2340
Date Public: 24 Mar 2016
Date First Published: 24 Mar 2016
Date Last Updated: 24 Mar 2016
Document Revision: 26

Feedback
If you have feedback, comments, or additional information about this vulnerability, please send us email.