CVE-2018-8031

Vulnerability

The Apache TomEE console (tomee-webapp) suffers from a reflected cross-site scripting (XSS) vulnerability. The application constructs a provider link using window.location.href without proper encoding, allowing an attacker to inject arbitrary JavaScript into the page via a malicious URL [1]. The vulnerable code is located in the JavaScript that sets the href and html attributes of the provider link element. Affected versions include all versions prior to Apache TomEE 7.0.5. The issue was fixed in commit b8bbf50c23ce97dd64f3a5d77f78f84e47579863 [3].

Exploitation

An attacker can craft a URL containing a JavaScript payload in the fragment or query string. If a user who is logged into the TomEE console clicks the malicious link, the console's JavaScript will append the entire URL (including the payload) to the provider link's href and html properties, causing the browser to execute the injected script. No authentication is needed to trigger the XSS, but the victim must be authenticated to the console session for useful impact.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the authenticated user's session. This can lead to session cookie theft, page content manipulation, or redirection to malicious sites. Since the console often has administrative privileges, the attacker may be able to perform actions on the TomEE server as the victim, potentially compromising the entire application server.

Mitigation

The vulnerability is fixed in Apache TomEE 7.0.5 [1]. Users should upgrade to this version or later. If upgrading is not immediately possible, administrators can remove the tomee-webapp application after initial setup or use one of the pre-configured TomEE bundles that do not include this web application [1]. No workaround within the application itself is available.