Apache CXF directory listing / code exfiltration

Vulnerability

Overview

CVE-2022-46363 is a misconfiguration vulnerability in Apache CXF, a Java-based services framework for building web services and REST APIs [1]. The flaw arises when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes enabled simultaneously—a combination that is explicitly not intended to be used together [1]. This misconfiguration allows an attacker to perform remote directory listing or code exfiltration.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the affected CXFServlet endpoint. The attack does not require authentication but does require the specific misconfiguration to be present [1]. The static-resources-list attribute enables listing of static resources, while redirect-query-check controls redirect behavior; their interaction under certain conditions exposes directory contents or allows retrieval of source code files.

Impact

Successful exploitation leads to information disclosure. An attacker can enumerate files and directories on the server, potentially revealing sensitive configuration files, source code, or other resources that could aid further attacks [1]. The severity is considered high due to the potential for code exfiltration.

Mitigation

The vulnerability is fixed in Apache CXF versions 3.5.5 and 3.4.10 [1]. Users are strongly advised to upgrade to these versions or later. As a workaround, administrators should ensure that the static-resources-list and redirect-query-check attributes are never used together in CXFServlet configuration [1].