When the application endpoint is designed to accept application/xml and processes the input using Source or StreamSource, the underlying SAXParser resolves the external entity defined in the malicious XML. This action forces the server to access and return the contents of local files on the system to the attacker in the HTTP response. Given that this requires no prior authentication, it poses a significant risk for unauthorized data exposure across any application utilizing the affected RESTEasy versions.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive local file contents from the host server. This vulnerability affects applications built using the RESTEasy framework, potentially leading to the compromise of configuration files, credentials, or other system-level data.

Recommendation

Detection engineering teams should monitor web traffic for XML payloads containing DOCTYPE declarations directed at application endpoints.

• Implement request body inspection on web application firewalls to identify and block incoming POST requests containing "DOCTYPE" or "ENTITY" keywords in the XML structure.
• Review application codebase to ensure that any use of SAXParser in SourceProvider-related implementations includes explicit configuration to disable DTD and external entity resolution.
• Update to the latest patched version of the RESTEasy framework as provided by the vendor.