Loading vulnerability…
RESTEasy DocumentProvider XML External Entity Expansion
CVE-2014-7839 is an XML External Entity (XXE) vulnerability in RESTEasy DocumentProvider, affecting RESTEasy 2.3.7 and 3.0.9. DocumentProvider did not appropriately disable or configure the XML parser external-general-entities and external-parameter-entities features. Consequently, attacker-controlled XML submitted to a RESTEasy endpoint can cause expansion of external entities.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can read files accessible to the application-server process account when XML parsing results are exposed through an application response or error condition. The weakness can also support broader XXE outcomes, such as server-side requests to externally referenced resources and resource exhaustion through malicious entity processing, subject to parser behavior and application configuration.
If you can’t patch tonight, do this now.
Disable DTD processing where not required and explicitly disable external general entities, external parameter entities, and external DTD loading in every XML parser configuration. Use hardened parser settings and secure-processing controls. Restrict outbound network access from application servers to reduce server-side request abuse, and run the application server under a minimally privileged account to limit accessible local files.
Patch, then assume compromise.
Upgrade RESTEasy or the affected JBoss product distribution to a vendor-provided fixed release. Red Hat addressed the issue in JBoss EAP 6.3.3 updates and in subsequent updates for JBoss Data Virtualization, JBoss Data Grid, JBoss BPM Suite, JBoss BRMS, and JBoss Portal Platform. Restart the JBoss server process after applying the update. Red Hat Web Framework Kit was out of maintenance and was not scheduled to receive a fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.