Return-Path: 
 <cxf-issues-return-5903-apmail-incubator-cxf-issues-archive=incubator.apache.org@incubator.apache.org>
Delivered-To: apmail-incubator-cxf-issues-archive@locus.apache.org
Received: (qmail 23564 invoked from network); 15 Feb 2008 19:42:29 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2)
  by minotaur.apache.org with SMTP; 15 Feb 2008 19:42:29 -0000
Received: (qmail 5655 invoked by uid 500); 15 Feb 2008 19:42:23 -0000
Delivered-To: apmail-incubator-cxf-issues-archive@incubator.apache.org
Received: (qmail 5632 invoked by uid 500); 15 Feb 2008 19:42:23 -0000
Mailing-List: contact cxf-issues-help@incubator.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:cxf-issues-help@incubator.apache.org>
List-Unsubscribe: <mailto:cxf-issues-unsubscribe@incubator.apache.org>
List-Post: <mailto:cxf-issues@incubator.apache.org>
List-Id: <cxf-issues.incubator.apache.org>
Reply-To: cxf-dev@incubator.apache.org
Delivered-To: mailing list cxf-issues@incubator.apache.org
Received: (qmail 5623 invoked by uid 99); 15 Feb 2008 19:42:23 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
    by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 15 Feb 2008 11:42:23 -0800
X-ASF-Spam-Status: No, hits=-2000.0 required=10.0
	tests=ALL_TRUSTED
X-Spam-Check-By: apache.org
Received: from [140.211.11.4] (HELO brutus.apache.org) (140.211.11.4)
    by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 15 Feb 2008 19:41:59 +0000
Received: from brutus (localhost [127.0.0.1])
	by brutus.apache.org (Postfix) with ESMTP id 5E443714087
	for <cxf-issues@incubator.apache.org>; Fri, 15 Feb 2008 11:42:08 -0800 (PST)
Message-ID: <27457401.1203104528383.JavaMail.jira@brutus>
Date: Fri, 15 Feb 2008 11:42:08 -0800 (PST)
From: "Daniel Kulp (JIRA)" <jira@apache.org>
To: cxf-issues@incubator.apache.org
Subject: [jira] Assigned: (CXF-1433) WS-Security vulnerability
In-Reply-To: <27482271.1203000789236.JavaMail.jira@brutus>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Virus-Checked: Checked by ClamAV on apache.org


     [ https://issues.apache.org/jira/browse/CXF-1433?page=3Dcom.atlassian.=
jira.plugin.system.issuetabpanels:all-tabpanel ]

Daniel Kulp reassigned CXF-1433:
--------------------------------

    Assignee: Daniel Kulp

> WS-Security vulnerability
> -------------------------
>
>                 Key: CXF-1433
>                 URL: https://issues.apache.org/jira/browse/CXF-1433
>             Project: CXF
>          Issue Type: Bug
>          Components: WS-* Components
>    Affects Versions: 2.0.3
>         Environment: Tomcat 5.5, Spring 2 and CXF 2.0.3 for the server an=
d Flex WS-client
>            Reporter: Lo=C3=AFc FRERING
>            Assignee: Daniel Kulp
>            Priority: Critical
>         Attachments: cxf-1433-fdushin-2008.02.15.patch
>
>
> It is possible to bypass the security checks configured with WS-Security.
> Server configured with an Username Token WS-Security authentication with =
Spring :
> <jaxws:endpoint id=3D"helloWorld" implementor=3D"service.impl.HelloWorldI=
mpl" address=3D"/HelloWorld">
> =09=09<jaxws:inInterceptors>
> =09=09=09<bean class=3D"org.apache.cxf.binding.soap.saaj.SAAJInIntercepto=
r"/>
> =09=09=09<bean class=3D"org.apache.cxf.ws.security.wss4j.WSS4JInIntercept=
or">
> =09=09=09=09<constructor-arg>
> =09=09=09=09=09<map>
> =09=09=09=09=09=09<entry key=3D"action" value=3D"UsernameToken"/>
> =09=09=09=09=09=09<entry key=3D"passwordType" value=3D"PasswordDigest"/>
> =09=09=09=09=09=09<entry key=3D"passwordCallbackClass" value=3D"service.s=
ecurity.ServerPasswordHandler"/>
> =09=09=09=09=09</map>
> =09=09=09=09</constructor-arg>
> =09=09=09</bean>
> =09=09=09<bean class=3D"org.apache.cxf.interceptor.LoggingInInterceptor"/=
>
> =09=09=09<bean class=3D"org.apache.cxf.interceptor.LoggingOutInterceptor"=
/>
> =09=09</jaxws:inInterceptors>
> =09</jaxws:endpoint>
> When a SOAP message is created and sent with the following header, the se=
rver do not process the authentication and return the response :
> <SOAP-ENV:Envelope>
> =09<SOAP-ENV:Header>
> =09        <ns0:Security>
>                         <ns0:wsse>Security</ns0:wsse>
>                 </ns0:Security>
>         </SOAP-ENV:Header>
> =09<SOAP-ENV:Body>
>         =09<ns0:sayHi>
>                         <name>Lo=C3=AFc</name>
>                 </ns0:sayHi>
>         </SOAP-ENV:Body>
> </SOAP-ENV:Envelope>
> So it is possible to bypass all the security checks configured and to use=
 it.

--=20
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.