CVE-2016-6812: Improper Neutralization of Input During Web Page Generation in Apache CXF
Summary
CVE-2016-6812: Improper Neutralization of Input During Web Page Generation in Apache CXF. Affects org.apache.cxf:cxf-core across 2 version ranges.
< 3.0.12
>= 3.1.0, < 3.1.9
Fixed in 3.0.12 or 3.1.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source web services framework that provides a comprehensive set of tools and libraries for building and consuming web services. It is widely used in Java-based applications for implementing SOAP and RESTful web services. The vulnerability identified as CVE-2016-6812 affects the HTTP transport module in Apache CXF versions prior to 3.0.12 and 3.1.x prior to 3.1.9. This module uses FormattedServiceListWriter to generate an HTML page that lists the available service endpoints. The base URL for building the service endpoint absolute URLs is calculated using the current HttpServletRequest. However, if unexpected matrix parameters are injected into the request URL, they can be reflected back to the client in the services list page, posing a cross-site scripting (XSS) risk to the client.
Vulnerability Detail
The vulnerability arises due to improper neutralization of input during web page generation in Apache CXF. When the HTTP transport module generates the services list page, it uses the HttpServletRequest to calculate the base URL for building the service endpoint absolute URLs. However, if the request URL contains unexpected matrix parameters, they can be included in the services list page, leading to a potential XSS attack. An attacker could inject malicious script code that would be executed in the context of the client's browser, potentially compromising the confidentiality and integrity of user data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.0.123.0.12 -
>= 3.1.0, < 3.1.93.1.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize the request URL to remove any unexpected matrix parameters before passing it to the Apache CXF HTTP transport module. This can be done by parsing the request URL and extracting the base URL without the matrix parameters. The sanitized URL can then be used to generate the services list page without the risk of including malicious matrix parameters.
Conclusion
The vulnerability CVE-2016-6812 in Apache CXF exposes a risk of cross-site scripting (XSS) attacks due to improper neutralization of input during web page generation. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Apache CXF (3.0.12 or later for Apache CXF 3.0.x, and 3.1.9 or later for Apache CXF 3.1.x). Developers can also implement a temporary workaround by manually sanitizing the request URL. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf-core →
FAQ
Apache CXF is an open-source web services framework for building and consuming SOAP and RESTful web services in Java-based applications.
The vulnerability allows for potential cross-site scripting (XSS) attacks, where an attacker can inject malicious script code that is executed in the client's browser, compromising user data confidentiality and integrity.
The vulnerability affects Apache CXF versions prior to 3.0.12 for applications using Apache CXF 3.0.x, and versions prior to 3.1.9 for applications using Apache CXF 3.1.x.
To fix the vulnerability, it is recommended to upgrade to Apache CXF version 3.0.12 or later for Apache CXF 3.0.x applications, and version 3.1.9 or later for Apache CXF 3.1.x applications.
As a temporary workaround, developers can manually sanitize the request URL to remove any unexpected matrix parameters before passing it to the Apache CXF HTTP transport module.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-core.
