Skip to content
OpenAdvisories
Medium · 6.1 Public exploit CVE-2016-6812 EUVD-2022-5439GHSA-vw2c-5wph-v92r

Improper Neutralization of Input During Web Page Generation in Apache CXF

Published Aug 10, 2017 · Updated Sep 17, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache CXF Package: org.apache.cxf:cxf-core Ecosystem: Maven

Description

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache CXF prior to 3.0.12, 3.1.x prior to 3.1.9 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.cxf:cxf-core < 3.0.12 3.0.12 GHSA-vw2c-5wph-v92r
Maven org.apache.cxf:cxf-core >= 3.1.0, < 3.1.9 3.1.9 GHSA-vw2c-5wph-v92r

Advisories 1

References