Loading vulnerability…
JBoss EAP JAX-RS RESTEasy XML External Entity Disclosure
CVE-2014-3481 is an XML External Entity (XXE) vulnerability in the JAX-RS integration for Red Hat JBoss Enterprise Application Platform. The default context parameters supplied to RESTEasy deployments did not explicitly disable XML external-entity expansion. A RESTEasy application accepting attacker-controlled XML could therefore resolve external entities during parsing.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can cause a vulnerable RESTEasy application to disclose arbitrary files readable by the application-server process, if the application returns parsed entity content or otherwise exposes it in its response.
If you can’t patch tonight, do this now.
Explicitly configure XML parsing for RESTEasy/JAX-RS endpoints to disable external general entities, external parameter entities, and external DTD loading. Where XML is not required, disable XML request processing or restrict endpoints to safer supported media types. Limit the application-server account's filesystem permissions to reduce the impact of potential disclosure.
Patch, then assume compromise.
Upgrade affected Red Hat JBoss Enterprise Application Platform installations to a vendor-fixed release. Red Hat addressed the flaw in JBoss EAP 6.2 updates released in June 2014; affected downstream JBoss products must be updated to their respective vendor-provided fixed releases. Restart the JBoss server process after applying updated packages.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.