Restlet Framework XML Deserialization Remote Code Execution Vulnerability

Bugtraq ID:	61694
Class:	Design Error
CVE:	CVE-2013-4221
Remote:	Yes
Local:	No
Published:	Aug 06 2013 12:00AM
Updated:	Jan 01 2014 01:02AM
Credit:	David Jorm, Dinis Cruz, Abraham Kang and Alvaro Munoz
Vulnerable:
Not Vulnerable:

Restlet Framework XML Deserialization Remote Code Execution Vulnerability

Restlet Framework is prone to a remote-code execution vulnerability.

Exploiting this issue will allow attackers to execute arbitrary code within the context of the affected application.

Restlet Framework 2.0 and 2.2 are vulnerable; other versions may also be affected.

Restlet Framework XML Deserialization Remote Code Execution Vulnerability

The researcher of this issue has created a proof-of-concept. Please see the references for more information.

Restlet Framework XML Deserialization Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Restlet Framework XML Deserialization Remote Code Execution Vulnerability

References:

• Restlet Framework Homepage (Restlet)