CVE-2017-14949: Restlet Framework allows remote attackers to access arbitrary files
Summary
CVE-2017-14949: Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request. Affects org.restlet.jse:org.restlet versions < 2.3.12. Fixed in 2.3.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Restlet Framework is a Java-based open-source framework that enables developers to build RESTful web services. It provides a set of APIs and tools for handling HTTP requests and responses, as well as data representation and routing. The framework is widely used in various applications and has a large user community.
Vulnerability Detail
The Restlet Framework before version 2.3.12 is vulnerable to a security issue that allows remote attackers to access arbitrary files. This vulnerability is due to improper handling of XML external entities (XXE) in certain REST API HTTP requests. Attackers can exploit this vulnerability by crafting a malicious request that conducts an XXE attack. The affected components include XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation. Only general external entities are properly considered, while parameter external entities are not. This vulnerability can lead to unauthorized access to sensitive files and potential information disclosure.
How To Fix
Minimum fixed version
2.3.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the Restlet Framework.
Conclusion
The Restlet Framework is vulnerable to a security issue that allows remote attackers to access arbitrary files. It is crucial for developers to upgrade to version 2.3.12 or later to mitigate this vulnerability. Applying the recommended fix will ensure that the framework properly handles XML external entities and prevents unauthorized access to sensitive files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.restlet.jse:org.restlet →
FAQ
This vulnerability allows remote attackers to access arbitrary files, potentially leading to unauthorized access and information disclosure.
Versions before 2.3.12 are affected by this vulnerability.
While specific exploits for this vulnerability may exist, they have not been disclosed publicly at this time.
Yes, the CVSS score for this vulnerability is 7.5 (High).
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert provides real-time monitoring and alerts for open-source vulnerabilities in software.
Related vulnerabilities
Recent vulnerabilities recorded for org.restlet.jse:org.restlet.
