Is XXE injection to /affwebservices/router/session still applicable in the current version of Access Gateway?

Products

• SITEMINDER
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)

Issue/Introduction

There is a community post about "SPS affwebservices/router/session resources vulnerable to an XXE injection attack".
Is this still applicable to current version of Access Gateway?

Environment

Access Gateway 12.x

Cause

Federation Web Service had /affwebservices/router/session mapped to a servlet in web.xml as below in R12.52SP1.

<servlet>     <servlet-name>router</servlet-name>     <display-name>Apache-SOAP RPC Router</display-name>     <description>This is the main servlet that dispatches the SOAP requests to registered web services</description>     <servlet-class>org.apache.soap.server.http.RPCRouterServlet</servlet-class>     <init-param>       <param-name>faultListener</param-name>       <param-value>org.apache.soap.server.DOMFaultListener</param-value>     </init-param>   </servlet>

Upon invocation it executes "org.apache.soap.server.http.RPCRouterServlet" and this appeared to have been exploitable at that time.

 

A fix was released on R12.52SP1CR6 removing the application from server.xml so the request to this servlet will just return HTTP 404.

Resolution

This fix is still there in R12.8 and R12.9

server.xml for affwebservices application does not have the router servlet.

As a result, HTTP 404 is returned.