GHSA-92j2-5r7p-6hjw

Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML

Source: GitHub Advisory Database (reviewed) High CVE-2013-4221

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.restlet.jse:org.restlet	< 2.1.4	2.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-4221 advisory
https://github.com/restlet/restlet-framework-java/issues/774 web
https://github.com/restlet/restlet-framework-java/commit/b85c2ef182c69c5e2e21df008ccb249ccf80c7b web
https://bugzilla.redhat.com/show_bug.cgi?id=995275 web
https://github.com/restlet/restlet-framework-java package
http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html web
http://restlet.org/learn/2.1/changes web
http://rhn.redhat.com/errata/RHSA-2013-1410.html web
http://rhn.redhat.com/errata/RHSA-2013-1862.html web