oss-security - CVE-2020-13954: Apache CXF Reflected XSS in the services listing page via the styleSheetPath

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 12 Nov 2020 12:37:40 +0000
From: Colm O hEigeartaigh <coheigea@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2020-13954: Apache CXF Reflected XSS in the services listing page
 via the styleSheetPath

Description:

By default, Apache CXF creates a /services page containing a listing of the
available endpoint names and addresses. This webpage is vulnerable to a
reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which
allows a malicious actor to inject javascript into the web page.

This vulnerability affects all versions of Apache CXF prior to 3.4.1 and
3.3.8.

Please note that this is a separate issue to CVE-2019-17573.

Workaround:

Users of Apache CXF should update to either 3.3.8 or 3.4.1. Alternatively,
it is possible to disable the service listing altogether by setting the
"hide-service-list-page" servlet parameter to "true".

Credit:

Thanks to Ryan Lambeth for reporting this issue.

References: http://cxf.apache.org/security-advisories.html

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.