CVE-2024-29736

Overview

Apache CXF is an open-source services framework, maintained by the Apache Software Foundation, for building and consuming web services in Java. It implements the JAX-WS and JAX-RS APIs and supports SOAP, the WS-* standards, RESTful HTTP, and OAuth 2.0 over transports such as HTTP and JMS. Its modules are published as Maven artifacts under org.apache.cxf.

A Server-Side Request Forgery (SSRF) vulnerability (CVE-2024-29736) has been identified in the WADL service description module of Apache CXF, which allows attackers to make a JAX-RS server that has a custom WADL stylesheet configured load and return arbitrary classpath, file, or URL resources by sending a GET request whose path ends in ".xsl".

Per OWASP: In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed.

This issue affects versions before 3.5.9, versions 3.6.0 through 3.6.3, and versions 4.0.0 through 4.0.4 of Apache CXF, including the End-of-Life 3.4.x line.

Details

Module Info

• Product: Apache CXF
• Affected packages: org.apache.cxf:cxf-rt-rs-service-description
• Affected versions: <3.5.9, >=3.6.0 <3.6.4, >=4.0.0 <4.0.5
• GitHub repository: https://github.com/apache/cxf
• Published packages: https://central.sonatype.com/artifact/org.apache.cxf/cxf-rt-rs-service-description
• Package manager: Maven
• Fixed in:
  • OSS Apache CXF 3.5.9, 3.6.4, 4.0.5
  • NES for Apache CXF v3.4.12

Vulnerability Info

This High-severity vulnerability is found in the org.apache.cxf:cxf-rt-rs-service-description package in versions before 3.5.9, versions 3.6.0 through 3.6.3, and versions 4.0.0 through 4.0.4 of Apache CXF.

WadlGenerator is a JAX-RS ContainerRequestFilter that serves WADL documents. When a stylesheetReference is configured, it also serves the XSL stylesheet that renders them. For every GET request that does not carry the _wadl query parameter, the filter takes the request path and, if a stylesheet is configured, treats any path ending in ".xsl" as a stylesheet request. It does not compare the path with the configured stylesheet reference:

UriInfo ui = context.getUriInfo();
if (!ui.getQueryParameters().containsKey(WADL_QUERY)) {
    if (stylesheetReference != null || !docLocationMap.isEmpty()) {
        String path = ui.getPath(false);
        if (path.startsWith("/") && path.length() > 0) {
            path = path.substring(1);
        }
        if (stylesheetReference != null && path.endsWith(".xsl")
            || docLocationMap.containsKey(path)) {
            context.abortWith(getExistingResource(m, ui, path));
        }
    }
    return;
}

The attacker-controlled path is then passed as href to getExistingResource. Because it is not a key in docLocationMap, it falls through to the stylesheet branch, which hands it directly to ResourceUtils.getResourceStream:

} else if (stylesheetReference != null && href.endsWith(".xsl")) {
    InputStream is = ResourceUtils.getResourceStream(href, m.getExchange().getBus());
    return Response.ok().type(MediaType.APPLICATION_XML_TYPE).entity(is).build();
}

ResourceUtils.getResourceStream resolves a value with a classpath: prefix as a classpath resource. Otherwise it tries to parse the value as a java.net.URL and, if that fails, looks it up as a classpath resource and then as a local file path, and opens the result. So a request path ending in ".xsl" makes the server open a URL, classpath resource, or local file of the attacker's choosing and return its contents in the response. The server does not check that the value matches the stylesheet the application actually configured. The request needs no privileges beyond access to a JAX-RS endpoint where WadlGenerator is registered with a custom stylesheet.

Mitigation

Only recent versions of Apache CXF receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Apache CXF release line (3.6.x or later) that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Tobias S. Fink (finder)