CVE-2016-6812

app("APACHE CXF"):
    requires(version: "ARMR/2.6")

    /***************************************************************************
        CVE-2016-6812 (APACHE CXF)

        CVSS 3.0 Summary:
            Base Score              | 6.1
            Attack Vector           | Network
            Attack Complexity       | Low
            Privileges Required     | None
            User Interaction        | Required
            Scope                   | Changed
            Confidentiality Impact  | Low
            Integrity Impact        | Low
            Availability Impact     | None

        Description:
            Apache CXF HTTP transport module uses FormattedServiceListWriter to
            provide a HTML page which lists the names and absolute URL addresses
            of the available service endpoints. The module calculates the base
            URL using the current HttpServletRequest. The calculated base URL is
            used by FormattedServiceListWriter to build the service endpoint
            absolute URLs. If the unexpected matrix parameters have been
            injected into the request URL then these matrix parameters will find
            their way back to the client in the services list page which
            represents an XSS risk to the client.

        Resources:
            https://github.com/apache/cxf/search?q=CXF-6216&type=Commits
            Two diffs, 'a23c615' is newer than '45b1b5b'

        Affected Operating Systems:
            Any

        Affected Versions:
            Apache CXF: 3.0.11, 3.1.8

        Tested Versions:
            2.7.18, 3.1.8

        Protection Provided:
            Functional

        Patch Version:
            1.1
    ***************************************************************************/

    patch("CVE-2016-6812 :01"):
        function("org/apache/cxf/transport/servlet/BaseUrlHelper.getBaseURL(Ljavax/servlet/http/HttpServletRequest;)Ljava/lang/String;",
            checksums: ["d06abf0b53",  // cxf-rt-transports-http-2.7.18
                        "6ca34af396"]) // cxf-rt-transports-http-3.1.8
        entry()

        code(language: java,   import: ["javax.servlet.ServletRequest",
                                        "javax.servlet.http.HttpServletRequest",
                                        "java.net.URI"]):
            public void patch(JavaFrame frame) {
                HttpServletRequest request = (HttpServletRequest) frame.loadObjectVariable(0);
                String reqPrefix = request.getRequestURL().toString();
                String pathInfo = request.getPathInfo();
                if (!"/".equals(pathInfo) || reqPrefix.contains(";")) {
                    StringBuilder sb = new StringBuilder();
                    URI uri = URI.create(reqPrefix);
                    sb.append(uri.getScheme()).append("://").append(uri.getRawAuthority());
                    String contextPath = request.getContextPath();
                    if (contextPath != null) {
                        sb.append(contextPath);
                    }
                    String servletPath = request.getServletPath();
                    if (servletPath != null) {
                        sb.append(servletPath);
                    }

                    reqPrefix = sb.toString();
                }
                frame.returnString(reqPrefix);
            }
        endcode
    endpatch

    patch("CVE-2016-6812 :02"):
        function("org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.getAbsoluteAddress(Ljava/lang/String;Lorg/apache/cxf/transport/AbstractDestination;)Ljava/lang/String;",
            checksums: ["ba371e8213",   // cxf-rt-transports-http-2.7.18
                        "0a39fe8248"])  // cxf-rt-transports-http-3.1.8
        callreturn("org/apache/cxf/service/model/EndpointInfo.getAddress()Ljava/lang/String;")

        code(language: java):
            public void patch(JavaFrame frame) {
                String endpointAddress = frame.loadStringOperand(0);
                if (endpointAddress.startsWith("http://") || endpointAddress.startsWith("https://")) {
                    return;
                } else {
                    String basePath = frame.loadStringVariable(1);
                    String address = basePath;
                    if (address.endsWith("/") && endpointAddress.startsWith("/")) {
                        address = address.substring(0, address.length() - 1);
                    }
                    frame.returnString(address + endpointAddress);
                }
            }
        endcode
    endpatch

    patch("CVE-2016-6812 :03"):
        function("org/apache/cxf/transport/servlet/servicelist/ServiceListGeneratorServlet.service(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;)V",
            checksums: ["5181258d31"])  // cxf-rt-transports-http-2.7.18
        callsite("org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.<init>(Ljava/lang/String;Ljava/lang/String;ZLjava/util/Map;)V")

        code(language: java,   import: ["javax.servlet.ServletRequest",
                                        "javax.servlet.http.HttpServletRequest"]):
            private static JavaField serviceListStyleSheetField;

            public void load() {
                serviceListStyleSheetField = JavaField.load("org/apache/cxf/transport/servlet/servicelist/ServiceListGeneratorServlet.serviceListStyleSheet");
            }

            public void patch(JavaFrame frame) {
                Object self = frame.loadThisVariable();
                HttpServletRequest request = (HttpServletRequest) frame.loadObjectVariable(1);
                String serviceListStyleSheet = serviceListStyleSheetField.readString(self);

                String styleSheetPath;
                if (serviceListStyleSheet != null) {
                    styleSheetPath = request.getContextPath() + "/" + serviceListStyleSheet;
                } else {
                    styleSheetPath = "";
                    String contextPath = request.getContextPath();
                    if (contextPath != null) {
                         styleSheetPath += contextPath;
                    }
                    String servletPath = request.getServletPath();
                    if (servletPath != null) {
                        styleSheetPath += servletPath;
                    }
                    String pathInfo = request.getPathInfo();
                    if (pathInfo != null) {
                        styleSheetPath += pathInfo;
                    }
                    if (!styleSheetPath.endsWith("/")) {
                        styleSheetPath += "/";
                    }
                    styleSheetPath += "?stylesheet=1";
                }
                frame.storeStringOperand(1, styleSheetPath);
            }
        endcode
    endpatch

    patch("CVE-2016-6812 :04"):
        function("org/apache/cxf/transport/servlet/servicelist/ServiceListGeneratorServlet.service(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;)V",
            checksums: ["d31fe23fd9"])  // cxf-rt-transports-http-3.1.8
        callsite("org/apache/cxf/transport/servlet/servicelist/FormattedServiceListWriter.<init>(Ljava/lang/String;Ljava/lang/String;ZLorg/apache/cxf/Bus;)V")

        code(language: java,   import: ["javax.servlet.ServletRequest",
                                        "javax.servlet.http.HttpServletRequest"]):
            private static JavaField serviceListStyleSheetField;

            public void load() {
                serviceListStyleSheetField = JavaField.load("org/apache/cxf/transport/servlet/servicelist/ServiceListGeneratorServlet.serviceListStyleSheet");
            }

            public void patch(JavaFrame frame) {
                Object self = frame.loadThisVariable();
                HttpServletRequest request = (HttpServletRequest) frame.loadObjectVariable(1);
                String serviceListStyleSheet = serviceListStyleSheetField.readString(self);

                String styleSheetPath;
                if (serviceListStyleSheet != null) {
                    styleSheetPath = request.getContextPath() + "/" + serviceListStyleSheet;
                } else {
                    styleSheetPath = "";
                    String contextPath = request.getContextPath();
                    if (contextPath != null) {
                         styleSheetPath += contextPath;
                    }
                    String servletPath = request.getServletPath();
                    if (servletPath != null) {
                        styleSheetPath += servletPath;
                    }
                    String pathInfo = request.getPathInfo();
                    if (pathInfo != null) {
                        styleSheetPath += pathInfo;
                    }
                    if (!styleSheetPath.endsWith("/")) {
                        styleSheetPath += "/";
                    }
                    styleSheetPath += "?stylesheet=1";
                }
                frame.storeStringOperand(1, styleSheetPath);
            }
        endcode
    endpatch

endapp