Guanping Zhang created CXF-9240:
-----------------------------------
Summary: OAuthJSONProvider.appendJsonPair() does not escape JSON
string values — output injection / malformed JSON in introspect & token
responses
Key: CXF-9240
URL: https://issues.apache.org/jira/browse/CXF-9240
Project: CXF
Issue Type: Bug
Components: JAX-RS Security
Affects Versions: 4.2.1
Environment: Apache CXF 4.2.1, Java 11+, OAuth2 AS endpoints
(introspect / token / error responses).
Reporter: Guanping Zhang
OAuthJSONProvider.appendJsonPair() (approx. lines 206-217) wraps string values
in double quotes but performs no JSON escaping of the value. Characters such as
'"', '\' and control characters (newline, CR, tab, etc.) are emitted verbatim,
producing structurally broken JSON or allowing injection of additional JSON
content (CWE-74; violates RFC 8259 §7 string escaping).
Responses serialized through this method include:
- /introspect (username, client_id, scope)
- /token (scope and custom parameters)
- error responses (error_description)
If an attacker can influence a serialized value that is later reflected in a
response, the unescaped output can alter the JSON parsed by downstream clients.
Impact is downstream-parser-dependent; this is primarily an output-encoding
correctness defect with potential security impact.
Suggested fix: apply proper JSON string escaping in appendJsonPair (escape '"',
'\' and control characters per RFC 8259 §7), or delegate serialization to the
existing JsonMapObjectReaderWriter, which handles escaping.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
