XML Signature Wrapping Bypass in Apache WSS4J

Executive Summary

In WSS4J's streaming code, a signature reference using WS-Security STR-Transform incorrectly sets an internal flag marking content as signed. This flag causes the WS-SecurityPolicy enforcer to skip further checks for signed elements, including the SOAP Body. As a result, a policy requiring the SOAP Body to be signed may be satisfied even without a valid signature, weakening protection against XML Signature Wrapping attacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass signature verification requirements by exploiting the flag mechanism. If your system relies on WS-SecurityPolicy to enforce signed SOAP Body elements, an attacker could modify the message without detection, potentially leading to unauthorized data access or manipulation. Systems using WSS4J versions before 4.0.2, 3.0.6, or 2.4.4 are vulnerable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability undermines integrity protections required by GDPR and HIPAA for data in transit. If message signatures are not properly validated, compliance with requirements for secure data transmission and non-repudiation may be compromised. Organizations must upgrade WSS4J to mitigate this risk and maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade WSS4J to versions 4.0.2, 3.0.6, or 2.4.4 to fix the issue. The DOM code is not affected, so ensure your system uses DOM instead of streaming (StAX) if possible.

Useful 0 Not Useful 0