CVE-2011-5245: Infoleak
RESTEasy permits XXE (XML eXternal Entity) attacks. If a RESTEasy endpoint is deployed, a user can submit a request containing an external XML entity. This XML entity will be resolved, allowing a remote attacker to read files in the context of the user running the application server. This flaw affects DOM Document, JAXB and Fast Infoset (FI) input.
Upstream bugs: https://issues.jboss.org/browse/RESTEASY-637 https://issues.jboss.org/browse/RESTEASY-647 https://issues.jboss.org/browse/RESTEASY-659
Other sources
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-5245?
CVE-2011-5245 is classified as a critical vulnerability due to its potential for remote file access.
How do I fix CVE-2011-5245?
To fix CVE-2011-5245, upgrade the RESTEasy library to version 2.3.2 or later.
Which versions are affected by CVE-2011-5245?
CVE-2011-5245 affects all versions of RESTEasy prior to 2.3.2, including versions 1.0.0 through 2.3.1.
What type of attack does CVE-2011-5245 permit?
CVE-2011-5245 permits XML eXternal Entity (XXE) attacks, which can lead to unauthorized file access.
Can I continue using RESTEasy if I have CVE-2011-5245?
It is highly discouraged to continue using affected versions of RESTEasy, as this could expose your application to critical risks.