Return-Path: 
 <cxf-issues-return-5897-apmail-incubator-cxf-issues-archive=incubator.apache.org@incubator.apache.org>
Delivered-To: apmail-incubator-cxf-issues-archive@locus.apache.org
Received: (qmail 65448 invoked from network); 15 Feb 2008 17:10:38 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2)
  by minotaur.apache.org with SMTP; 15 Feb 2008 17:10:38 -0000
Received: (qmail 9312 invoked by uid 500); 15 Feb 2008 17:10:28 -0000
Delivered-To: apmail-incubator-cxf-issues-archive@incubator.apache.org
Received: (qmail 9293 invoked by uid 500); 15 Feb 2008 17:10:27 -0000
Mailing-List: contact cxf-issues-help@incubator.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:cxf-issues-help@incubator.apache.org>
List-Unsubscribe: <mailto:cxf-issues-unsubscribe@incubator.apache.org>
List-Post: <mailto:cxf-issues@incubator.apache.org>
List-Id: <cxf-issues.incubator.apache.org>
Reply-To: cxf-dev@incubator.apache.org
Delivered-To: mailing list cxf-issues@incubator.apache.org
Received: (qmail 9254 invoked by uid 99); 15 Feb 2008 17:10:27 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
    by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 15 Feb 2008 09:10:27 -0800
X-ASF-Spam-Status: No, hits=-2000.0 required=10.0
	tests=ALL_TRUSTED
X-Spam-Check-By: apache.org
Received: from [140.211.11.4] (HELO brutus.apache.org) (140.211.11.4)
    by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 15 Feb 2008 17:09:49 +0000
Received: from brutus (localhost [127.0.0.1])
	by brutus.apache.org (Postfix) with ESMTP id 5F2FE714083
	for <cxf-issues@incubator.apache.org>; Fri, 15 Feb 2008 09:10:09 -0800 (PST)
Message-ID: <30394682.1203095409385.JavaMail.jira@brutus>
Date: Fri, 15 Feb 2008 09:10:09 -0800 (PST)
From: "Fred Dushin (JIRA)" <jira@apache.org>
To: cxf-issues@incubator.apache.org
Subject: [jira] Commented: (CXF-1433) WS-Security vulnerability
In-Reply-To: <27482271.1203000789236.JavaMail.jira@brutus>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Virus-Checked: Checked by ClamAV on apache.org


    [ https://issues.apache.org/jira/browse/CXF-1433?page=3Dcom.atlassian.j=
ira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D125693=
19#action_12569319 ]=20

Fred Dushin commented on CXF-1433:
----------------------------------


I believe this is due to:

https://issues.apache.org/jira/browse/WSS-70

I'll be submitting a patch to CXF shortly which works around this issue.

> WS-Security vulnerability
> -------------------------
>
>                 Key: CXF-1433
>                 URL: https://issues.apache.org/jira/browse/CXF-1433
>             Project: CXF
>          Issue Type: Bug
>          Components: WS-* Components
>    Affects Versions: 2.0.3
>         Environment: Tomcat 5.5, Spring 2 and CXF 2.0.3 for the server an=
d Flex WS-client
>            Reporter: Lo=C3=AFc FRERING
>            Priority: Critical
>
> It is possible to bypass the security checks configured with WS-Security.
> Server configured with an Username Token WS-Security authentication with =
Spring :
> <jaxws:endpoint id=3D"helloWorld" implementor=3D"service.impl.HelloWorldI=
mpl" address=3D"/HelloWorld">
> =09=09<jaxws:inInterceptors>
> =09=09=09<bean class=3D"org.apache.cxf.binding.soap.saaj.SAAJInIntercepto=
r"/>
> =09=09=09<bean class=3D"org.apache.cxf.ws.security.wss4j.WSS4JInIntercept=
or">
> =09=09=09=09<constructor-arg>
> =09=09=09=09=09<map>
> =09=09=09=09=09=09<entry key=3D"action" value=3D"UsernameToken"/>
> =09=09=09=09=09=09<entry key=3D"passwordType" value=3D"PasswordDigest"/>
> =09=09=09=09=09=09<entry key=3D"passwordCallbackClass" value=3D"service.s=
ecurity.ServerPasswordHandler"/>
> =09=09=09=09=09</map>
> =09=09=09=09</constructor-arg>
> =09=09=09</bean>
> =09=09=09<bean class=3D"org.apache.cxf.interceptor.LoggingInInterceptor"/=
>
> =09=09=09<bean class=3D"org.apache.cxf.interceptor.LoggingOutInterceptor"=
/>
> =09=09</jaxws:inInterceptors>
> =09</jaxws:endpoint>
> When a SOAP message is created and sent with the following header, the se=
rver do not process the authentication and return the response :
> <SOAP-ENV:Envelope>
> =09<SOAP-ENV:Header>
> =09        <ns0:Security>
>                         <ns0:wsse>Security</ns0:wsse>
>                 </ns0:Security>
>         </SOAP-ENV:Header>
> =09<SOAP-ENV:Body>
>         =09<ns0:sayHi>
>                         <name>Lo=C3=AFc</name>
>                 </ns0:sayHi>
>         </SOAP-ENV:Body>
> </SOAP-ENV:Envelope>
> So it is possible to bypass all the security checks configured and to use=
 it.

--=20
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.