Server-Side Request Forgery (SSRF) in Apache Batik - CVE-2022-40146

Vulnerability identifier: #VU67585

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2022-40146

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of URLs in jar files. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Apache Batik
Oracle Fusion Middleware MapViewer
IBM Business Automation Workflow
IBM Intelligent Operations Center
Dell Secure Connect Gateway
Confluence Data Center
IBM Tivoli Netcool/OMNIbus WebGUI
Jira Software Data Center
IBM Integration Bus
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
Maximo Manage Application in IBM Maximo Application Suite
IBM Maximo Application Suite
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Software Development Kit 12
Ubuntu
openEuler
Oracle Financial Services Revenue Management and Billing
Oracle Communications MetaSolv Solution
Confluence Server
Jira Software Server
IBM Case Manager
Jazz Reporting Service
IBM App Connect Enterprise
Red Hat Camel for Spring Boot
libbatik-java (Ubuntu package)
batik
dev-java/batik
batik-help
xmlgraphics-batik
Engineering Test Management
IBM Engineering Systems Design Rhapsody
Fuse

Install updates from vendor's website.

Apache Batik - update to 1.15
IBM Intelligent Operations Center - update to 5.2.4
Dell Secure Connect Gateway - update to 5.16
Confluence Data Center - update to 7.19.16
Confluence Server - update to 7.19.16
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.39
Jira Software Data Center - addressed in versions 9.4.16, 9.12.4
Jira Software Server - addressed in versions 9.4.16, 9.12.4
libbatik-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.10-2~18.04.1, 1.12-1ubuntu0.1, 1.14-1ubuntu0.2, 1.14-2ubuntu0.1
batik - update to 1.7-10.10
dev-java/batik - update to 1.17
batik - update to 1.17-1
batik-help - update to 1.17-1
xmlgraphics-batik - update to 1.17-2.7.1
Red Hat Camel for Spring Boot - update to 3.20.1
IBM Case Manager - update to 5.3.3-IF011
Engineering Test Management - addressed in versions 7.0.1.0.22, 7.0.2.0.22
Jazz Reporting Service - update to 7.0.2 iFix021
IBM Maximo Asset Management - addressed in versions 7.6.1.2.0.31, 7.6.1.3.0.6
Fuse - update to 7.12.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Maximo Manage Application in IBM Maximo Application Suite - update to 8.4.7
IBM Maximo Application Suite - update to 8.8.7
IBM Engineering Systems Design Rhapsody - update to 9.0.1.0.5

• Exploit #8559 - CVE-2022-40146_Exploit_Jar () (November 1, 2022)

• https://issues.apache.org/jira/browse/BATIK-1335
• https://www.zerodayinitiative.com/advisories/ZDI-22-1327/

• Multiple SSRF vulnerabilities in Apache Batik
• Server-Side Request Forgery (SSRF) in Oracle Communications MetaSolv Solution
• Multiple vulnerabilities in Oracle Fusion Middleware MapViewer
• Amazon Linux AMI update for batik
• Multiple vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Maximo Asset Management
• Multiple vulnerabilities in Oracle Financial Services Revenue Management and Billing
• Multiple vulnerabilities in IBM Engineering Test Management (ETM)
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot
• Ubuntu update for batik
• Multiple vulnerabilities in IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in IBM Intelligent Operations Center (IOC)
• Multiple vulnerabilities in IBM Jazz Reporting Service
• Multiple vulnerabilities in IBM Business Automation Workflow and IBM Case Manager
• Multiple vulnerabilities in IBM Cloud Application Performance Management (APM)
• Multiple vulnerabilities in Confluence Data Center and Server
• Gentoo update for Apache Batik
• SUSE update for xmlgraphics-batik
• openEuler update for batik
• SSRF in Jira Software Data Center and Server batik-bridge component
• Multiple vulnerabilities in Fuse 7
• IBM Tivoli Netcool/OMNIbus WebGUI update for Apache Batik library