CVE-2020-1954: Apache CXF - Exposure of Sensitive Information to an Unauthorized Actor
Summary
CVE-2020-1954: Apache CXF JMX Integration is vulnerable to a MITM attack. Affects org.apache.cxf:cxf-rt-management across 2 version ranges.
< 3.2.13
>= 3.3.0, < 3.3.6
Fixed in 3.2.13 or 3.3.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is a popular open-source framework for building web services. It provides a comprehensive set of tools and libraries for developing SOAP and RESTful services. The framework integrates with JMX (Java Management Extensions) by registering an InstrumentationManager extension with the CXF bus. This allows for monitoring and managing the CXF runtime environment. However, if the 'createMBServerConnectorFactory' property of the default InstrumentationManagerImpl is not disabled, it becomes vulnerable to a man-in-the-middle (MITM) style attack.
Vulnerability Detail
The vulnerability in Apache CXF allows an attacker on the same host to connect to the JMX registry and rebind the entry to another server, effectively acting as a proxy to the original. This enables the attacker to intercept and access all the information that is sent and received over JMX. The impact of this vulnerability can be significant, as it exposes sensitive information to an unauthorized actor, potentially leading to data breaches or unauthorized access to the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.2.133.2.13 -
>= 3.3.0, < 3.3.63.3.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of Apache CXF is not immediately feasible, a temporary workaround is to manually disable the 'createMBServerConnectorFactory' property in the InstrumentationManagerImpl configuration. This can be done by modifying the CXF configuration file or programmatically disabling the property during runtime. Here is an example of how to disable the property programmatically:
InstrumentationManagerImpl manager = new InstrumentationManagerImpl();
manager.setCreateMBServerConnectorFactory(false);
Note that this workaround is not a permanent solution and should be followed by upgrading to a fixed version of Apache CXF as soon as possible.
Conclusion
The vulnerability in Apache CXF exposes sensitive information to unauthorized actors through a man-in-the-middle attack. Upgrading to the latest version of Apache CXF or applying the provided workaround is crucial to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf-rt-management →
FAQ
Apache CXF is an open-source framework for building web services. It provides tools and libraries for developing SOAP and RESTful services.
JMX (Java Management Extensions) is a Java technology that provides a standard way of managing and monitoring applications, devices, and services.
A man-in-the-middle attack is a type of cyber attack where an attacker intercepts and alters communications between two parties without their knowledge.
This vulnerability can lead to exposure of sensitive information to an unauthorized actor. It can result in data breaches, unauthorized access to the system, and potential compromise of the application or infrastructure.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
