WebSphere Application Server 敏感信息泄露（CVE-2020-4449）

## The Information Disclosure Gadget (CVE-2020-4449) This gadget is due to an XXE when parsing the WSIF service definition XML described above. The vulnerable code is shown below: ``` public static Definition readWSDL(String contextURL, String wsdlLoc) throws WSDLException { Trc.entry(null, contextURL, wsdlLoc); initializeProviders(); WSDLFactory factory = WSDLFactory.newInstance("org.apache.wsif.wsdl.WSIFWSDLFactoryImpl"); WSDLReader wsdlReader = factory.newWSDLReader(); // <--------------------- wsdlReader.setFeature("javax.wsdl.verbose", false); try { Definition def = wsdlReader.readWSDL(contextURL, wsdlLoc); // <--------- Trc.exitExpandWsdl(def); return def; } catch (WSDLException e) { Trc.exception(e); MessageLogger.log("WSIF.0002E", wsdlLoc); throw e; } } ``` This gadget also demonstrates bypassing mitigations in modern JREs. Specifically, out-of-band extraction (eg: via FTP) is prevented in modern JREs. In this particular case, the data is extracted via error messages, so it is critical that the parsing of the XML document is not wrapped in a try/catch statement. The following video shows this gadget in action: https://youtu.be/_lWU-tzVybc