BEGIN PGP SIGNED MESSAGE----
CVE-2013-0239: Authentication bypass in the case of WS-SecurityPolicy enabled
Vendor: The Apache Software Foundation
This vulnerability affects all versions of Apache CXF prior to 2.5.9, 2.6.6
The following WS-SecurityPolicy 1.3 fragment requires that a WS-Security
UsernameToken must be present in the security header of a SOAP request:
If a UsernameToken element is sent with no password child element, then a
policy similar to the policy defined above will completely bypass
authentication by default. This is due to the use-case of supporting deriving
keys from a UsernameToken, where a password element would not be sent in the
The vulnerability does not apply in any of the following circumstances:
a) You are using a custom UsernameTokenValidator which does not allow the
'verifyUnknownPassword' use-case, or that otherwise insists that a password
must be present in the token (such as the 'JAASUsernameTokenValidator' in
b) You are using a 'sp:HashPassword' policy that requires a hashed password
to be present in the token.
c) You are using the older style of configuring WS-Security without using
If you are relying on WS-SecurityPolicy enabled plaintext UsernameTokens to
authenticate users, and if neither points a) nor b) apply, then you must
upgrade to a fixed version of CXF (see below), or else configure a custom
UsernameTokenValidator implementation to insist that a password element must
The fix has been to require a password element in the case of a (non-endorsing)
This has been fixed in revisions:
Users of CXF prior to 2.5.x should upgrade to either 2.5.9, 2.6.6, or 2.7.3.
CXF 2.5.x users should upgrade to 2.5.9 as soon as possible.
CXF 2.6.x users should upgrade to 2.6.6 as soon as possible.
CXF 2.7.x users should upgrade to 2.7.3 as soon as possible.
BEGIN PGP SIGNATURE----
Version: GnuPG v1.4.11 (GNU/Linux)
END PGP SIGNATURE----