Improper Input Validation Affecting org.apache.santuario:xmlsec Open this link in a new tab package, versions [2.2.0,2.2.3) [,2.1.7)

  • Attack Complexity


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    20 Sep 2021

  • disclosed

    20 Sep 2021

  • credit


How to fix?

Upgrade org.apache.santuario:xmlsec to version 2.2.3, 2.1.7 or higher.


org.apache.santuario:xmlsec is a package to provide implementation of the primary security standards for XML, XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.

Affected versions of this package are vulnerable to Improper Input Validation due to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.