Apache CXF 7pk security

Summaryinfo

A vulnerability was found in Apache CXF. It has been declared as critical. This issue affects some unknown processing. The manipulation results in 7pk security. This vulnerability was named CVE-2018-8039. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Apache CXF (Application Server Software) (version now known). Affected is some unknown processing. The manipulation with an unknown input leads to a 7pk security vulnerability. CWE is classifying the issue as CWE-254. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.

The bug was discovered 06/28/2018. The weakness was presented 07/02/2018 (Website). The advisory is shared for download at lists.apache.org. This vulnerability is traded as CVE-2018-8039 since 03/09/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1211.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 111486 (RHEL 6 / 7 : JBoss EAP (RHSA-2018:2276)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Red Hat Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 236935 (Red Hat Update for JBoss Enterprise Application Platform 7.1.4 on RHEL7 (RHSA-2018:2424)).

Upgrading eliminates this vulnerability. A possible mitigation has been published 4 weeks after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (111486). See VDB-122300, VDB-137946, VDB-137885 and VDB-137924 for similar entries. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• CXF

License

• open-source

Website

• Vendor: https://www.apache.org/
• Product: https://github.com/apache/cxf/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion