PT-2017-13773 · Restlet · Restlet Framework

Man Yue Mo · Published 2017-11-30 · Updated 2018-10-17 · CVE-2017-14949

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Restlet Framework versions prior to 2.3.12

Description The issue allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE (XML External Entity) attack. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation. The problem arises because only general external entities, not parameter external entities, are properly considered.

Recommendations For versions prior to 2.3.12, update to version 2.3.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API or disabling the use of XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation until the update can be applied.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-14949

GHSA-CVJ4-G3GX-8VQQ

Affected Products

Restlet Framework

References · 12

• 🔥 https://lgtm.com/blog/restlet_CVE-2017-14949 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-14949 · Security Note
• https://ubuntu.com/security/CVE-2017-14949 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14949 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14949 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-14949 · Security Note
• https://osv.dev/vulnerability/GHSA-cvj4-g3gx-8vqq · Vendor Advisory
• https://github.com/restlet/restlet-framework-java · Note
• https://github.com/restlet/restlet-framework-java/commit/fe75aff3af23b879b984db7a2b6824cee0ef0fc5 · Note
• https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements · Note
• https://github.com/advisories/GHSA-cvj4-g3gx-8vqq · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14949 · Note