[CXF-8672] CXF /services page causing vulnerable to a reflected Cross-Site Scripting (XSS) attack in latest and Older CXF version

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Cannot Reproduce
• Affects Version/s: 3.4.5, 3.5.1
• Component/s: JAX-RS Security

Environment

Java -11

Windows

• Estimated Complexity: Unknown
• Assignee: Unassigned
• Reporter: chandra
• Created: 09/Mar/22 06:50
• Updated: 18/Sep/23 18:49
• Resolved: 25/Mar/22 09:44

Description

we're creating a JAX-WS endpoint based on our implementation class. We have attached our web.xml file and our beans.xml file where we are exposing our services param.

we found out that while listing our services endpoint using CXF servlet we are facing security issues.

Actually we have a URL:-

 URL http://localhost:8080/app/services/"><script>alert(document.domain)</script>sz2q2 and the XSS vulnerability is working fine in this. It is giving error when we add <script> tag in URL which contains domains name or cookie and it should be work in this way.

But as soon as we enter "/services" at last place in URL(see below)

URL http:// localhost:8080/app /services/"><script>alert(document.domain)</script>sz2q2/services

it will list down wadl services which are exposed. In this case it should throw error. "/services" is handled by CXF servlet in web.xml. We looked into CXF sites and found that it is known bug in CXF library which was not fixed in latest cxf version too e.g. 3.5.1.

This URL is OK http:// localhost:8080/app /services > giver wadl
This URL is OK-http:// localhost:8080/app /services/"><script>alert(document.domain)</script>sz2q2 -> gives error as "No services found" handling <script> tag as XSS protection.

But this URL is not OK and it should be fixed by CXF library - http:// localhost:8080/app /services/"><script>alert(document.domain)</script>sz2q2/services ->gives wadl