Apache CXF Reflected XSS in the services listing page via the styleSheetPath

Vulnerability

Description

CVE-2020-13954 is a reflected cross-site scripting (XSS) vulnerability in the Apache CXF framework's /services listing page. By default, Apache CXF generates a page that displays available endpoint names and addresses. The page accepts a styleSheetPath parameter that is reflected in the response without proper sanitization or encoding. An attacker can craft a malicious URL containing JavaScript in the styleSheetPath parameter, which will be executed in the context of the victim's browser when the page is loaded [1][2].

Exploitation

The attack surface is the publicly accessible /services page, which is enabled by default. No authentication is required to trigger the XSS. The attacker needs only to convince a user to click a crafted link or visit a maliciously constructed URL that includes the payload in the styleSheetPath parameter. The lack of input validation means that any JavaScript code can be injected directly into the page's HTML [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The impact is compounded because the /services page may be accessible to unauthenticated users, making it a low-barrier entry point for attacks.

Mitigation

Apache CXF versions prior to 3.4.1 and 3.3.8 are affected. Users should upgrade to these patched versions. As a workaround, administrators can disable the service listing entirely by setting the hide-service-list-page servlet parameter to true. The fix ensures the styleSheetPath parameter is properly encoded before being reflected in the response [1][2].