Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1675138

Summary:	[GSS](6.4.z) Code-Injection via JSONP-Injection in REST-Services
Product:	[JBoss] JBoss Enterprise Application Platform 6	Reporter:	Maria Vassileva <mavassil>
Component:	Web Services, RESTEasy	Assignee:	Chao Wang <chaowan>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Peter Mackay <pmackay>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	TBD EAP 6	CC:	asoldano, bmaxwell, chaowan, dereed, rpelisse, thofman
Target Milestone:	CR1
Target Release:	EAP 6.4.22
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Release Note
Doc Text:	Because JSONP can be used in Cross Site Scripting Inclusion (XSSI) attacks, JacksonJsonpInterceptor is disabled by default. Two steps are necessary to enable it: * JacksonJsonpInterceptor must be added to the deployment, e.g. by adding a service file META-INF/services/javax.ws.rs.ext.Providers with the line org.jboss.resteasy.plugins.providers.jackson.JacksonJsonpInterceptor on the classpath. * The servlet context parameter parameter "resteasy.jsonp.enable" must be set to "true".	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-19 12:40:57 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1613417, 1675264

Description Maria Vassileva 2019-02-11 20:26:13 UTC

Description of problem:

CVE-2016-6348 RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack. 
In EAP 7.1+, setting the system property "resteasy.jsonp.enable" to false  will disable Jackson2JsonpInterceptor and it will just proceed to the next interceptor.
Back-port this capability in EAP 6.4.

Comment 10 Tomas Hofman 2019-03-13 14:51:41 UTC

In the upstream this interceptor can already be disabled, i.e. no upstream required.

@Brad, can you set requires_doc_text+? I can't.

@Chao, can you provide doc text?

Comment 14 Peter Mackay 2019-05-08 20:17:56 UTC

Regression tests passed
Verified with EAP 6.4.22.CP.CR1