Server-Side Request Forgery (SSRF) in Apache Batik - CVE-2022-44730

Vulnerability identifier: #VU80019

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2022-44730

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input when parsing SVG images. A remote user can upload a malicious SVG image and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Apache Batik
IBM Integration Bus
IBM Business Automation Workflow
IBM Intelligent Operations Center
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
Development Tools Module
openSUSE Leap
openEuler
IBM Qradar SIEM
Juniper Secure Analytics (JSA)
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
dev-java/batik
batik-help
batik
xmlgraphics-batik
xmlgraphics-batik-demo
xmlgraphics-batik-css
xmlgraphics-batik-rasterizer
xmlgraphics-batik-slideshow
xmlgraphics-batik-javadoc
xmlgraphics-batik-squiggle
xmlgraphics-batik-ttf2svg
xmlgraphics-batik-svgpp
Red Hat Camel for Spring Boot
IBM App Connect Enterprise
Engineering Test Management
IBM Business Automation Manager Open Editions
IBM Engineering Systems Design Rhapsody

Install updates from vendor's website.

Apache Batik - update to 1.17
IBM Intelligent Operations Center - update to 5.2.5
IBM Qradar SIEM - update to 7.5.0 Update Pack 7 IF02
Juniper Secure Analytics (JSA) - update to 7.5.0 UP7 IF02
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.5
dev-java/batik - update to 1.17
batik-help - update to 1.17-1
batik - update to 1.17-1
xmlgraphics-batik - addressed in versions 1.17-2.7.1, 1.17-150200.4.7.1
xmlgraphics-batik-demo - update to 1.17-150200.4.7.1
xmlgraphics-batik-css - update to 1.17-150200.4.7.1
xmlgraphics-batik-rasterizer - update to 1.17-150200.4.7.1
xmlgraphics-batik-slideshow - update to 1.17-150200.4.7.1
xmlgraphics-batik-javadoc - update to 1.17-150200.4.7.1
xmlgraphics-batik-squiggle - update to 1.17-150200.4.7.1
xmlgraphics-batik-ttf2svg - update to 1.17-150200.4.7.1
xmlgraphics-batik-svgpp - update to 1.17-150200.4.7.1
Red Hat Camel for Spring Boot - update to 4.0.0
Engineering Test Management - addressed in versions 7.0.1.0.23, 7.0.2.0.25
IBM Maximo Asset Management - addressed in versions 7.6.1.2.40, 7.6.1.3.15
IBM Business Automation Manager Open Editions - update to 8.0.5
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
IBM Maximo Application Suite - addressed in versions 8.6.8, 8.7.3
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.1.0.6, 9.0.2.0.2
IBM App Connect Enterprise - addressed in versions 11.0.0.23, 12.0.10.0

• https://lists.apache.org/thread/58m5817jr059f4v1zogh0fngj9pwjyj0
• https://xmlgraphics.apache.org/security.html
• http://www.openwall.com/lists/oss-security/2023/08/22/3
• http://www.openwall.com/lists/oss-security/2023/08/22/5
• https://issues.apache.org/jira/browse/BATIK-1347

• Multiple SSRF vulnerabilities in Apache Batik
• Multiple vulnerabilities in IBM Engineering Test Management (ETM)
• Multiple vulnerabilities in IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot 4.0
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in IBM Business Automation Workflow
• Gentoo update for Apache Batik
• Multiple vulnerabilities in IBM Maximo Asset Management
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM Application Performance Management
• SUSE update for xmlgraphics-batik
• SUSE update for xmlgraphics-batik
• openEuler update for batik
• Multiple vulnerabilities in Red Hat Process Automation Manager 7.13
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Intelligent Operations Center (IOC)
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody