CVE-2013-4221

Public PoC / Exploit

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

Weaknesses (CWE)

CWE-16CWE-91

Affected Products (16)

restlet · restletvulnerable

References (12)

http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html

Third Party Advisory

http://restlet.org/learn/2.1/changes

Release NotesVendor Advisory

http://rhn.redhat.com/errata/RHSA-2013-1410.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-1862.html

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=995275

Issue TrackingThird Party Advisory

https://github.com/restlet/restlet-framework-java/issues/774

Issue TrackingPatch

http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html

Third Party Advisory

http://restlet.org/learn/2.1/changes

Release NotesVendor Advisory

http://rhn.redhat.com/errata/RHSA-2013-1410.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-1862.html

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=995275

Issue TrackingThird Party Advisory

https://github.com/restlet/restlet-framework-java/issues/774

Issue TrackingPatch