Bug 1675138 - [GSS](6.4.z) Code-Injection via JSONP-Injection in REST-Services
Summary: [GSS](6.4.z) Code-Injection via JSONP-Injection in REST-Services
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: JBoss Enterprise Application Platform 6
Classification: JBoss
Component: Web Services, RESTEasy
Version: TBD EAP 6
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: CR1
: EAP 6.4.22
Assignee: Chao Wang
QA Contact: Peter Mackay
URL:
Whiteboard:
Depends On:
Blocks: eap6422-payload 1675264
TreeView+ depends on / blocked
 
Reported: 2019-02-11 20:26 UTC by Maria Vassileva
Modified: 2019-08-19 12:40 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Release Note
Doc Text:
Because JSONP can be used in Cross Site Scripting Inclusion (XSSI) attacks, JacksonJsonpInterceptor is disabled by default. Two steps are necessary to enable it: * JacksonJsonpInterceptor must be added to the deployment, e.g. by adding a service file META-INF/services/javax.ws.rs.ext.Providers with the line org.jboss.resteasy.plugins.providers.jackson.JacksonJsonpInterceptor on the classpath. * The servlet context parameter parameter "resteasy.jsonp.enable" must be set to "true".
Clone Of:
Environment:
Last Closed: 2019-08-19 12:40:57 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RESTEASY-1486 0 Minor Resolved CVE-2016-6348: Use of JacksonJsonpInterceptor can lead to Cross Site Script Inclusion attack 2019-06-06 02:29:30 UTC

Description Maria Vassileva 2019-02-11 20:26:13 UTC 
Description of problem:

CVE-2016-6348 RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack. 
In EAP 7.1+, setting the system property "resteasy.jsonp.enable" to false  will disable Jackson2JsonpInterceptor and it will just proceed to the next interceptor.
Back-port this capability in EAP 6.4.
Comment 10 Tomas Hofman 2019-03-13 14:51:41 UTC 
In the upstream this interceptor can already be disabled, i.e. no upstream required.

@Brad, can you set requires_doc_text+? I can't.

@Chao, can you provide doc text?
Comment 14 Peter Mackay 2019-05-08 20:17:56 UTC 
Regression tests passed
Verified with EAP 6.4.22.CP.CR1
Note You need to log in before you can comment on or make changes to this bug.