Exploitation Summary
EIP tracks 2 public exploits for CVE-2017-7661. PoCs published by dawetmaster, andikahilmy.
AI-analyzed exploit summary This repository contains vulnerable code for CVE-2017-7661, an XXE vulnerability in Apache CXF Fediz. The provided Java servlets demonstrate the vulnerable components that allow XML External Entity (XXE) processing, which can lead to information disclosure or server-side request forgery (SSRF).
Description
Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4.
Exploits (2)
This repository contains vulnerable code for CVE-2017-7661, an XXE vulnerability in Apache CXF Fediz. The provided Java servlets demonstrate the vulnerable components that allow XML External Entity (XXE) processing, which can lead to information disclosure or server-side request forgery (SSRF).
This repository contains vulnerable code from Apache CXF Fediz, demonstrating CVE-2017-7661, which involves improper validation of SAML tokens leading to authentication bypass. The provided servlet examples show how claims and tokens are processed, highlighting the vulnerability in the token validation logic.
References (8)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H