REDHAT-BUG-785631: Medium severity JBoss RESTEasy vulnerability
RESTEasy permits XXE (XML eXternal Entity) attacks. If a RESTEasy endpoint is deployed, a user can submit a request containing an external XML entity. This XML entity will be resolved, allowing a remote attacker to read files in the context of the user running the application server. This flaw affects DOM Document, JAXB and Fast Infoset (FI) input.
Upstream bugs: https://issues.jboss.org/browse/RESTEASY-637 https://issues.jboss.org/browse/RESTEASY-647 https://issues.jboss.org/browse/RESTEASY-659
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-785631?
The severity of REDHAT-BUG-785631 is high due to its potential for an attacker to exploit XXE vulnerabilities to access sensitive files.
How do I fix REDHAT-BUG-785631?
To fix REDHAT-BUG-785631, ensure that your RESTEasy configuration disallows external entities and validate incoming XML documents.
What is the impact of REDHAT-BUG-785631?
The impact of REDHAT-BUG-785631 is that it can allow remote attackers to read local files from the server hosting the RESTEasy application.
Which versions are affected by REDHAT-BUG-785631?
All versions of JBoss RESTEasy that permit the use of XML external entities are affected by REDHAT-BUG-785631.
Is REDHAT-BUG-785631 a common vulnerability?
Yes, REDHAT-BUG-785631 reflects a common vulnerability known as XXE, which is frequently targeted in web applications.