CVE-2014-3490: Incorrect Privilege Assignment in RESTEasy
Summary
CVE-2014-3490: Incorrect Privilege Assignment in RESTEasy. Affects org.jboss.resteasy:resteasy-client across 2 version ranges.
>= 2.3.1, < 2.3.8.SP2
>= 3.0.0, < 3.0.9.Final
Fixed in 2.3.8.SP2 or 3.0.9.Final, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RESTEasy is a framework for building RESTful web services in Java. It is commonly used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0. This vulnerability affects RESTEasy versions 2.3.1 to 2.3.8.SP2 and versions 3.0.0 to 3.0.9. It is related to an XML External Entity (XXE) issue and occurs when the resteasy.document.expand.entity.references parameter is set to false. The vulnerability allows remote attackers to read arbitrary files and potentially have other unspecified impacts.
Vulnerability Detail
The vulnerability arises due to an incomplete fix for CVE-2012-0818. When the resteasy.document.expand.entity.references parameter is set to false, RESTEasy does not disable external entities. This allows attackers to exploit an XML External Entity (XXE) issue and gain unauthorized access to files on the server. The impact of this vulnerability can vary depending on the specific vectors used by the attacker.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.1, < 2.3.8.SP22.3.8.SP2 -
>= 3.0.0, < 3.0.9.Final3.0.9.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A possible workaround for this vulnerability is to manually disable external entities in the RESTEasy configuration. This can be done by setting the resteasy.document.expand.entity.references parameter to false in the application's configuration file. Here is an example of how to do this in a web.xml file:
<init-param>
<param-name>resteasy.document.expand.entity.references</param-name>
<param-value>false</param-value>
</init-param>
Conclusion
In conclusion, the vulnerability CVE-2014-3490 in RESTEasy allows remote attackers to read arbitrary files and potentially have other unspecified impacts. It is important to upgrade to the fixed versions of RESTEasy and properly configure the resteasy.document.expand.entity.references parameter to prevent the exploitation of XXE vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jboss.resteasy:resteasy-client →
FAQ
The impact of this vulnerability can vary depending on the specific vectors used by the attacker. It allows remote attackers to read arbitrary files and potentially have other unspecified impacts.
Versions 2.3.1 to 2.3.8.SP1 and versions 3.0.0 to 3.0.8.Final are affected by this vulnerability.
Yes, fixed versions of RESTEasy are available. For versions 2.3.1 to 2.3.8.SP1, upgrading to version 2.3.8.SP2 is recommended. For versions 3.0.0 to 3.0.8.Final, upgrading to version 3.0.9.Final is necessary.
Yes, this vulnerability can be mitigated by properly configuring the resteasy.document.expand.entity.references parameter to prevent the exploitation of XXE vulnerabilities.
Yes, a possible workaround is to manually disable external entities in the RESTEasy configuration by setting the resteasy.document.expand.entity.references parameter to false.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss.resteasy:resteasy-client.
