CVE-2016-6347: Cross-Site Scripting Vulnerability in RESTEasy
Summary
CVE-2016-6347: Improper Neutralization of Input During Web Page Generation in RESTEasy. Affects org.jboss.resteasy:resteasy-client across 2 version ranges.
< 3.0.20.Final
>= 3.1.0.Beta1, < 3.1.0.CR1
Fixed in 3.0.20.Final or 3.1.0.CR1, depending on the release line you run. How to fix ↓
Also tracked for
- resteasy3.0 · Debian:11
The same CVE-2016-6347 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RESTEasy is a Java-based framework for building RESTful web services. It provides a set of annotations and utilities to simplify the development of RESTful APIs. The RESTEasy client package, specifically versions 3.0.19.Final and below, as well as versions 3.1.0.Beta2 and below, are affected by a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML into web pages generated by RESTEasy.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation in RESTEasy. The default exception handler in RESTEasy fails to properly sanitize user-supplied input, allowing malicious actors to inject arbitrary web script or HTML. This can lead to various attacks, such as session hijacking, defacement of web pages, or theft of sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.0.20.Final3.0.20.Final -
>= 3.1.0.Beta1, < 3.1.0.CR13.1.0.CR1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround is to implement input validation and sanitization on the server-side to prevent the injection of malicious scripts or HTML. This can be achieved by using appropriate input validation libraries or frameworks, such as OWASP Java Encoder, to sanitize user-supplied input before rendering it in web pages.
Conclusion
In conclusion, the RESTEasy client package is vulnerable to a cross-site scripting (XSS) attack due to improper input neutralization. Upgrading to the fixed versions or implementing input validation and sanitization can mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jboss.resteasy:resteasy-client →
FAQ
The vulnerability allows remote attackers to inject arbitrary web script or HTML into web pages generated by RESTEasy. This can lead to various attacks, such as session hijacking, defacement of web pages, or theft of sensitive information.
Versions 3.0.19.Final and below, as well as versions 3.1.0.Beta2 and below, are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade the RESTEasy client package to version 3.0.20.Final or above if using versions 3.0.x, or to version 3.1.0.CR1 or above if using versions 3.1.x.
A temporary workaround is to implement input validation and sanitization on the server-side to prevent the injection of malicious scripts or HTML.
You can find more information about this vulnerability in the CVE-2016-6347 advisory and the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss.resteasy:resteasy-client.
