Description

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T17:17:37.717Z",
  "pubdate": "2026-08-31T17:17:37.717Z",
  "executiveSummary": "This vulnerability is an XML External Entity (XXE) flaw discovered within the RESTEasy framework's SourceProvider component.\nThe issue arises from insecure XML parsing configurations that allow the resolution of external entities during the processing of application/xml payloads.\nAn unauthenticated, remote attacker can exploit this weakness by injecting malicious DOCTYPE declarations into an XML body sent to specific API endpoints.\nSuccessful exploitation results in the unauthorized retrieval of sensitive local system files, which are subsequently reflected in the application's HTTP response.\nThe impact includes critical information disclosure, potentially exposing configuration files, credentials, or other protected data stored on the host filesystem.\nThe vulnerability is categorized as high risk due to the lack of required authentication, enabling remote attackers to read arbitrary files with the privileges of the application process.\nRemediation requires updating the affected library or implementing strict security configurations for the underlying XML parser to disable DTD processing and external entity resolution.",
  "technicalDetails": "The vulnerability originates in the SourceProvider.writeTo() method, which fails to securely configure the SAXParser responsible for processing incoming XML data. By default, the SAX parser is initialized without explicitly disabling the resolution of external entities defined in Document Type Definitions (DTDs).\nAn XML External Entity (XXE) attack is a type of injection vulnerability where an attacker embeds a malicious DOCTYPE declaration within the XML request body. This declaration defines an external entity that references a URI, such as a local file path (e.g., file:///etc/passwd).\nThe attack flow proceeds as follows: First, the attacker crafts an HTTP request with a Content-Type header set to application/xml. The body contains the malicious XML payload defining the external entity. Second, the request is directed to a RESTEasy endpoint that expects a Source or StreamSource object. Third, the SourceProvider component triggers the underlying SAXParser to parse the document. Because external entity resolution is not explicitly restricted, the parser processes the DOCTYPE declaration and attempts to fetch the content from the specified URI. Finally, the parser resolves the entity by reading the contents of the targeted file and injecting that data into the resulting object, which is then serialized and returned in the HTTP response, effectively exfiltrating the file content to the attacker.\nThis vulnerability specifically impacts RESTEasy environments where endpoints are configured to automatically marshal or unmarshal XML input using the vulnerable SourceProvider. The exploit requires no authentication, allowing any remote user with network access to the endpoint to perform arbitrary file reads. The privilege level of the file access is restricted only by the permissions of the user account running the Java application server. Post-exploitation, the attacker gains the ability to map the server filesystem, extract configuration properties, obtain environment variables, or retrieve sensitive application source code, facilitating further escalation or lateral movement within the infrastructure."
}