CVE-2019-17573: Reflected Cross-Site Scripting in Apache CXF
Summary
CVE-2019-17573: Reflected Cross-Site Scripting in Apache CXF. Affects org.apache.cxf:apache-cxf across 2 version ranges.
< 3.2.12
>= 3.3.0, < 3.3.5
Fixed in 3.2.12 or 3.3.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source web services framework that allows developers to build and deploy services using various protocols and data formats. It provides a default /services page that lists available endpoint names and addresses. This page is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which enables malicious actors to inject JavaScript code into the webpage. Although modern browsers typically remove dot segments before sending requests, mobile applications may still be vulnerable to this attack.
Vulnerability Detail
The vulnerability in Apache CXF allows for a reflected XSS attack on the default /services page. This means that an attacker can inject malicious JavaScript code into the page, which will be executed by the victim's browser. The impact of this vulnerability can range from unauthorized access to sensitive information to complete takeover of the user's session. It is important to note that this vulnerability has a moderate severity rating (CVSS score of 6.1) and is associated with CWE-79.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.2.123.2.12 -
>= 3.3.0, < 3.3.53.3.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of Apache CXF is not immediately feasible, a temporary workaround is to disable or remove the /services page from the application. This can be done by modifying the application's configuration or by customizing the CXF servlet to exclude the /services endpoint. Here is an example of how to disable the /services page in a CXF servlet configuration:
<bean id="cxfServlet" class="org.apache.cxf.transport.servlet.CXFServlet">
<property name="serviceListAvailable" value="false" />
Conclusion
In conclusion, the CVE-2019-17573 vulnerability in Apache CXF exposes applications to a reflected XSS attack on the default /services page. It is crucial for developers to upgrade to the latest version of Apache CXF or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:apache-cxf →
FAQ
Apache CXF is an open-source web services framework that allows developers to build and deploy services using various protocols and data formats.
A reflected XSS attack is a type of security vulnerability where an attacker injects malicious code into a website, which is then executed by the victim's browser.
The impact of this vulnerability can range from unauthorized access to sensitive information to complete takeover of the user's session.
To fix this vulnerability, it is recommended to upgrade to Apache CXF version 3.2.12 or higher.
Yes, a temporary workaround is to disable or remove the /services page from the application.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:apache-cxf.
