Bug 1400644 (CVE-2016-9606) - CVE-2016-9606 Resteasy: Yaml unmarshalling vulnerable to RCE
Summary: CVE-2016-9606 Resteasy: Yaml unmarshalling vulnerable to RCE
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-9606
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1403661 1404912
Blocks: 1400646 1460775
TreeView+ depends on / blocked
 
Reported: 2016-12-01 17:08 UTC by Adam Mariš
Modified: 2021-02-17 02:57 UTC (History)
73 users (show)

Fixed In Version: resteasy 3.0.22, resteasy 3.1.2
Doc Type: If docs needed, set a value
Doc Text:
It was discovered that under certain conditions RESTEasy could be forced to parse a request with YamlProvider, resulting in unmarshalling of potentially untrusted data. An attacker could possibly use this flaw execute arbitrary code with the permissions of the application using RESTEasy.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:02:55 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1253 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Enterprise Application Platform 6.4.15 update on RHEL 7 2017-05-19 01:06:53 UTC
Red Hat Product Errata RHSA-2017:1254 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Enterprise Application Platform 6.4.15 update on RHEL 6 2017-05-19 00:46:50 UTC
Red Hat Product Errata RHSA-2017:1255 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Enterprise Application Platform security update 2017-05-19 01:37:17 UTC
Red Hat Product Errata RHSA-2017:1256 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Enterprise Application Platform 6.4.15 update on RHEL 5 2017-05-19 01:27:12 UTC
Red Hat Product Errata RHSA-2017:1260 0 normal SHIPPED_LIVE Moderate: jboss-ec2-eap security, bug fix, and enhancement update 2017-05-19 02:09:26 UTC
Red Hat Product Errata RHSA-2017:1409 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Enterprise Application Platform security update 2017-06-07 20:37:27 UTC
Red Hat Product Errata RHSA-2017:1410 0 normal SHIPPED_LIVE Moderate: JBoss Enterprise Application Platform 7.0.6 on Red Hat Enterprise Linux 6 2017-06-07 21:00:45 UTC
Red Hat Product Errata RHSA-2017:1411 0 normal SHIPPED_LIVE Moderate: JBoss Enterprise Application Platform 7.0.6 on Red Hat Enterprise Linux 7 2017-06-07 20:58:48 UTC
Red Hat Product Errata RHSA-2017:1412 0 normal SHIPPED_LIVE Moderate: eap7-jboss-ec2-eap security update 2017-06-07 21:22:17 UTC
Red Hat Product Errata RHSA-2017:1675 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss BPM Suite security update 2017-07-04 22:00:22 UTC
Red Hat Product Errata RHSA-2017:1676 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss BRMS security update 2017-07-04 22:00:02 UTC
Red Hat Product Errata RHSA-2018:2909 0 None None None 2018-10-11 12:37:57 UTC
Red Hat Product Errata RHSA-2018:2913 0 None None None 2018-10-11 14:19:07 UTC

Description Adam Mariš 2016-12-01 17:08:24 UTC
It was found that SnakeYAML unmarshalling is exploitable for code execution. As RESTeasy enables the yaml provider by default, therefore this is exploitable for JAX-RS applications specifiying either a yaml content type @Consumes or one without type specifiction.

Comment 1 Adam Mariš 2016-12-01 17:09:30 UTC
Acknowledgments:

Name: Moritz Bechler (AgNO3 GmbH & Co. KG)

Comment 4 Jason Shepherd 2016-12-09 03:20:17 UTC
For Resteasy, it's a requirement that the @Consumes() annotation doesn't define a mime type, or defines a multipart mime type. Explicitly defining 'text/x-yaml', would also make that endpoint vulnerable. If the @Consumes annotation explicitly defines a 'application/json', or 'application/xml' it is not vulnerable.

Comment 5 Jason Shepherd 2016-12-12 06:11:14 UTC
Resteasy versions from 3.0-beta-1 up to and including 3.1.0.CR3 are potentially affected.

Resteasy versions from 2.2.0.GA in the 2.x range are also potentially affected.

Comment 6 Jason Shepherd 2016-12-12 06:24:49 UTC
EAP 7.0 is not affected because a bug in Resteasy which prevents the loading of YamlProvider in that version. The YamlProvider is unsupported:

https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/7.0/paged/700-release-notes/chapter-3-unsupported-and-deprecated-functionality

However we do plan to fix this issue in EAP 7.1

Comment 9 Jason Shepherd 2016-12-13 01:52:20 UTC
Mitigation:

Add authentication and authorization to any Resteasy endpoint which doesn't define a mime type, or defines a multipart mime type.

Comment 12 Jason Shepherd 2016-12-15 04:55:58 UTC
Created resteasy tracking bugs for this issue:

Affects: fedora-all [bug 1404912]

Comment 15 Jason Shepherd 2017-02-28 23:41:19 UTC
Upstream tracker can be found here: https://issues.jboss.org/browse/RESTEASY-1618

Comment 17 Martin Prpič 2017-03-28 10:18:31 UTC
Please note that the previous CVE (CVE-2016-9571) was rejected in favor of the newly assigned CVE-2016-9606. This was because the CVE-2016-9571 ID was mistakenly double-assigned by MITRE to a Camel issue:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9571

Comment 18 Jason Shepherd 2017-04-02 23:51:19 UTC
Statement:

YamlProvider was removed the default list of providers to prevent a malicous user from requesting a payload be marshalled with Yaml. If marshalling of Yaml content is desired, add, or append a file with the name 'META-INF/services/javax.ws.rs.ext.Providers' to your WAR, or JAR with the contents 'org.jboss.resteasy.plugins.providers.YamlProvider'

If YamlProvider is re-added to the default list of providers it's recommended to add authentication, and authorization to the endpoint expecting Yaml content to prevent exploitation of this vulnerablilty.

Comment 19 Tomas Hoger 2017-04-12 12:53:32 UTC
(In reply to Jason Shepherd from comment #15)
> Upstream tracker can be found here:
> https://issues.jboss.org/browse/RESTEASY-1618

According to the information in the still non-public RESTEASY-1618, this was fixed in resteasy 3.0.22 and 3.1.2.

The following upstream commit references RESTEASY-1618:

https://github.com/resteasy/Resteasy/commit/bccadffa2df8ecaff6616df18d2f3b1210866b99

It seems to disable Yaml provider.

There is no mention of the change in the announcement blog post or upstream release notes:

https://developer.jboss.org/en/resteasy/blog/2017/03/31/resteasy-312final-and-3022final-are-out

https://issues.jboss.org/secure/ReleaseNote.jspa?version=12333793&styleName=Text&projectId=12310560&Create=Create
https://issues.jboss.org/secure/ReleaseNote.jspa?version=12333792&styleName=Text&projectId=12310560&Create=Create

Comment 20 errata-xmlrpc 2017-05-18 20:49:52 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2017:1254 https://access.redhat.com/errata/RHSA-2017:1254

Comment 21 errata-xmlrpc 2017-05-18 21:10:04 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7

Via RHSA-2017:1253 https://access.redhat.com/errata/RHSA-2017:1253

Comment 22 errata-xmlrpc 2017-05-18 21:30:19 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5

Via RHSA-2017:1256 https://access.redhat.com/errata/RHSA-2017:1256

Comment 23 errata-xmlrpc 2017-05-18 21:37:38 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4.15

Via RHSA-2017:1255 https://access.redhat.com/errata/RHSA-2017:1255

Comment 24 errata-xmlrpc 2017-05-18 22:09:52 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2017:1260 https://access.redhat.com/errata/RHSA-2017:1260

Comment 26 errata-xmlrpc 2017-06-07 16:38:09 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0.6

Via RHSA-2017:1409 https://rhn.redhat.com/errata/RHSA-2017-1409.html

Comment 27 errata-xmlrpc 2017-06-07 17:04:24 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7

Via RHSA-2017:1411 https://access.redhat.com/errata/RHSA-2017:1411

Comment 28 errata-xmlrpc 2017-06-07 17:05:29 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6

Via RHSA-2017:1410 https://access.redhat.com/errata/RHSA-2017:1410

Comment 29 errata-xmlrpc 2017-06-07 17:22:38 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6

Via RHSA-2017:1412 https://access.redhat.com/errata/RHSA-2017:1412

Comment 30 errata-xmlrpc 2017-07-04 18:01:07 UTC
This issue has been addressed in the following products:

  Red Hat JBoss BRMS

Via RHSA-2017:1676 https://access.redhat.com/errata/RHSA-2017:1676

Comment 31 errata-xmlrpc 2017-07-04 18:02:16 UTC
This issue has been addressed in the following products:

  Red Hat JBoss BPM Suite

Via RHSA-2017:1675 https://access.redhat.com/errata/RHSA-2017:1675

Comment 37 errata-xmlrpc 2018-10-11 12:37:35 UTC
This issue has been addressed in the following products:

  Red Hat Process Automation

Via RHSA-2018:2909 https://access.redhat.com/errata/RHSA-2018:2909

Comment 38 errata-xmlrpc 2018-10-11 14:18:47 UTC
This issue has been addressed in the following products:

  Red Hat Decision Manager

Via RHSA-2018:2913 https://access.redhat.com/errata/RHSA-2018:2913

Comment 39 errata-xmlrpc 2018-12-03 14:57:09 UTC
This issue has been addressed in the following products:

  Red Hat Process Automation

Via RHSA-2017:1675 https://access.redhat.com/errata/RHSA-2017:1675

Comment 40 errata-xmlrpc 2018-12-03 14:57:36 UTC
This issue has been addressed in the following products:

  Red Hat Decision Manager

Via RHSA-2017:1676 https://access.redhat.com/errata/RHSA-2017:1676


Note You need to log in before you can comment on or make changes to this bug.