CVE-2020-6958
📋 TL;DR
This CVE describes an XML External Entity (XXE) vulnerability in JnlpSupport within Yet Another Java Service Wrapper (YAJSW) version 12.14. It allows attackers to read files from remote hosts and potentially cause denial-of-service by parsing malicious XML. This affects systems running NSA Ghidra and other products that use YAJSW 12.14.
💻 Affected Systems
- Yet Another Java Service Wrapper (YAJSW)
- NSA Ghidra
📦 What is this software?
Yet Another Java Service Wrapper by Yet Another Java Service Wrapper Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers can exfiltrate sensitive files from the server, including configuration files, credentials, and system files, potentially leading to complete system compromise.
Likely Case
Data exfiltration from vulnerable servers, potentially exposing sensitive information stored on the system.
If Mitigated
Limited impact if proper network segmentation and input validation are in place, though the vulnerability still exists.
🎯 Exploit Status
Public proof-of-concept code exists demonstrating file exfiltration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: YAJSW versions after 12.14
Vendor Advisory: https://sourceforge.net/p/yajsw/bugs/166/
Restart Required: Yes
Instructions:
1. Upgrade YAJSW to a version after 12.14. 2. Update any dependent applications like Ghidra. 3. Restart affected services.
🔧 Temporary Workarounds
Disable JnlpSupport
allDisable the vulnerable JnlpSupport feature if not required.
Modify YAJSW configuration to set jnlp.support.enabled=false
XML Parser Hardening
allConfigure XML parsers to disable external entity resolution.
Set XML parser properties: FEATURE_SECURE_PROCESSING=true, DISALLOW_DOCTYPE_DECL=true
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy web application firewall (WAF) rules to block XXE payloads
🔍 How to Verify
Check if Vulnerable:
Check YAJSW version: grep 'version' in YAJSW configuration files or check installed package version.Check Version:
java -jar yajsw.jar -v (or check wrapper.conf for version)Verify Fix Applied:
Verify YAJSW version is greater than 12.14 and test with XXE payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- File access attempts via XML entities
- Outbound connections to external entities
Network Indicators:
- HTTP requests with XML payloads containing external entity references
- Outbound connections to unexpected external hosts
SIEM Query:
source="*yajsw*" AND (message="*XXE*" OR message="*external entity*" OR message="*DOCTYPE*")🔗 References
- https://github.com/NationalSecurityAgency/ghidra/issues/943
- https://github.com/purpleracc00n/Exploits-and-PoC/blob/master/XXE%20in%20YAJSW%E2%80%99s%20JnlpSupport%20affects%20Ghidra%20Server.md
- https://sourceforge.net/p/yajsw/bugs/166/
- https://github.com/NationalSecurityAgency/ghidra/issues/943
- https://github.com/purpleracc00n/Exploits-and-PoC/blob/master/XXE%20in%20YAJSW%E2%80%99s%20JnlpSupport%20affects%20Ghidra%20Server.md
- https://sourceforge.net/p/yajsw/bugs/166/
