Server-Side Request Forgery (SSRF) in xmltooling - CVE-2023-36661

Vulnerability identifier: #VU77574

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2023-36661

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input when processing URL in XMLToolingConfig.cpp. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

xmltooling
Debian Linux
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
openSUSE Leap
Ubuntu
libxmltooling6v5 (Ubuntu package)
xmltooling-debugsource
libxmltooling-devel
xmltooling-schemas
libxmltooling6
libxmltooling6-debuginfo
libxmltooling7-debuginfo
libxmltooling7
libxmltooling-lite9
libxmltooling9-debuginfo
xmltooling-debuginfo
libxmltooling-lite9-debuginfo
libxmltooling9
xmltooling (Debian package)

Install updates from vendor's website.

xmltooling - update to 3.2.4
libxmltooling6v5 (Ubuntu package) - update to Ubuntu Pro
xmltooling-debugsource - addressed in versions 1.5.6-3.13.1, 3.1.0-150300.3.3.1
libxmltooling-devel - addressed in versions 1.5.6-3.13.1, 3.1.0-150300.3.3.1
xmltooling-schemas - addressed in versions 1.5.6-3.13.1, 3.1.0-150300.3.3.1
libxmltooling6 - update to 1.5.6-3.13.1
libxmltooling6-debuginfo - update to 1.5.6-3.13.1
libxmltooling7-debuginfo - update to 1.6.4-150000.3.10.1
libxmltooling7 - update to 1.6.4-150000.3.10.1
libxmltooling-lite9 - update to 3.1.0-150300.3.3.1
libxmltooling9-debuginfo - update to 3.1.0-150300.3.3.1
xmltooling-debuginfo - update to 3.1.0-150300.3.3.1
libxmltooling-lite9-debuginfo - update to 3.1.0-150300.3.3.1
libxmltooling9 - update to 3.1.0-150300.3.3.1
xmltooling (Debian package) - addressed in versions 3.2.0-3+deb11u1, 3.2.3-1+deb12u1

• Exploit #9556 - Ivanti Connect Secure Unauthenticated Remote Code Execution (February 21, 2024)

• https://shibboleth.net/community/advisories/secadv_20230612.txt
• https://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=6080f6343f98fec085bc0fd746913ee418cc9d30

• Server-Side Request Forgery (SSRF) in Shibboleth xmltooling
• Debian update for xmltooling
• SUSE update for xmltooling
• SUSE update for xmltooling
• SUSE update for xmltooling
• Ubuntu update for xmltooling