CVE-2014-7839: XML External Entity Reference in RESTEasy
Summary
CVE-2014-7839: XML External Entity Reference in RESTEasy. Affects org.jboss.resteasy:resteasy-jaxrs versions < 3.0.11.Final. Fixed in 3.0.11.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The RESTEasy package is a JAX-RS implementation that provides a framework for building RESTful web services in Java. It is commonly used in enterprise applications to develop and deploy RESTful APIs. The vulnerability identified as CVE-2014-7839 affects versions 2.3.7 and 3.0.9 of RESTEasy. This vulnerability allows remote attackers to exploit XML external entity (XXE) attacks due to the lack of proper configuration of external entities features in the DocumentProvider class.
Vulnerability Detail
The vulnerability arises from the failure to configure the external-general-entities and external-parameter-entities features in the DocumentProvider class of RESTEasy. This oversight enables attackers to launch XML external entity (XXE) attacks through unspecified vectors. By exploiting this vulnerability, remote attackers can potentially gain unauthorized access to sensitive information, perform denial-of-service attacks, or execute arbitrary code on the affected system.
How To Fix
Minimum fixed version
3.0.11.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to implement input validation and sanitization techniques when processing XML data. This can help mitigate the risk of XML external entity (XXE) attacks. Developers should also consider using secure XML parsing libraries that provide built-in protection against XXE vulnerabilities.
Conclusion
The XML External Entity Reference vulnerability in RESTEasy can lead to serious security risks, including unauthorized access, denial-of-service attacks, and arbitrary code execution. It is crucial for developers using affected versions of RESTEasy to upgrade to the fixed version and ensure proper configuration of external entities. Regularly monitoring for vulnerabilities, such as using Vulert, can help maintain the security of your software.
See every vulnerability recorded for org.jboss.resteasy:resteasy-jaxrs →
FAQ
RESTEasy is a JAX-RS implementation that allows developers to build RESTful web services in Java. It provides a framework for handling HTTP requests and responses, mapping them to Java objects, and facilitating the development of RESTful APIs.
An XML external entity (XXE) attack is a type of vulnerability that occurs when an XML parser processes external entities defined in the XML document. Attackers can exploit this vulnerability to read sensitive files, perform denial-of-service attacks, or execute arbitrary code.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert analyzes your project's pom.xml file and provides real-time alerts for open-source vulnerabilities, including CVE-2014-7839.
No, only versions 2.3.7 and 3.0.9 of RESTEasy are affected by this vulnerability. It is recommended to upgrade to version 3.0.11.Final or later to mitigate the vulnerability.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to apply the recommended fix to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss.resteasy:resteasy-jaxrs.
