An Apache CXF endpoint can be used as an intermediary, where a token credential from the received message is used as a delegation token to obtain a new token from a Security Token Service (STS) for the outbound request.

By default, the token retrieved from the STS is cached and associated with the delegation token via an identifier extracted from the delegation token.

However, there is a weakness in how the identifier is extracted from the delegation token, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

External References:

http://cxf.apache.org/security-advisories.data/CVE-2017-5656.txt.asc

Upstream patch:

https://github.com/apache/cxf/commit/66c2c5b99e01a2165a2c5ed9ae34b4b9a512cb39

Apache CXF JAX-RS implementation provides a number of Atom MessageBodyReaders. These readers use Apache Abdera Parser to parse Atom feeds or Entries, with this Parser expanding XML entities by default. This represents a major XXE risk.

External References:

http://cxf.apache.org/security-advisories.data/CVE-2016-8739.txt.asc?version=1&modificationDate=1482164360575&api=v2

Apache CXF OAuth2 Hawk and JOSE MAC Validation code is not using a constant time MAC signature comparison algorithm which may be exploited by some sophisticated timing attacks. It may only affect OAuth2 Hawk or JWT access tokens or JOSE JWS/JWE interceptors which depend on HMac secret key algorithms.

This vulnerability affects all versions of Apache CXF prior to 3.0.13, 3.1.10.

Upstream patches:

CXF 3.1.x: http://git-wip-us.apache.org/repos/asf/cxf/commit/555843f9

CXF 3.0.x http://git-wip-us.apache.org/repos/asf/cxf/commit/1338469f

CXF 3.2.0-SNAPSHOT (master): http://git-wip-us.apache.org/repos/asf/cxf/commit/e66ce235

External References:

https://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc