Server-Side Request Forgery (SSRF) in Apache CXF - CVE-2024-28752

Vulnerability identifier: #VU87567

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2024-28752

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in Aegis DataBinding. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Apache CXF
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Watson Query on Cloud Pak for Data
IBM QRadar Incident Forensics
Red Hat Integration Camel-K
Oracle Communications Session Report Manager
Oracle WebCenter Forms Recognition
Red Hat Integration Camel Extensions for Quarkus
HPE Telco IP Mediation E-Media
IBM Maximo Application Suite
JBoss Enterprise Application Platform
IBM Tivoli Application Dependency Discovery Manager
Oracle Communications Element Manager
IBM Qradar SIEM
Oracle Commerce Platform
Oracle Communications Cloud Native Core Unified Data Repository
eap7-jboss-annotations (Red Hat package)
eap7-jboss-jsf (Red Hat package)
eap7-wildfly-http-client (Red Hat package)
eap7-wildfly-transaction-client (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
eap7-wildfly-discovery (Red Hat package)
eap7-h2database (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-avro (Red Hat package)
eap7-jboss-modules (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-bouncycastle (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
eap7-xml-security (Red Hat package)
eap7-undertow (Red Hat package)
eap7-wss4j (Red Hat package)
eap7-xalan-j2 (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-infinispan (Red Hat package)
eap7-jboss-metadata (Red Hat package)
Red Hat Camel for Spring Boot

Install updates from vendor's website.

Apache CXF - addressed in versions 3.5.8, 3.6.3, 4.0.4
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 3.2.0
Watson Query on Cloud Pak for Data - update to 3.2.0
Red Hat Integration Camel-K - update to 1.10.8
JBoss Enterprise Application Platform - addressed in versions 7.1.8, 7.3.11, 7.4.17
IBM Qradar SIEM - update to 7.5.0 Update Pack 10
eap7-jboss-annotations (Red Hat package) - update to api_1.3_spec-2.0.1-4.Final_redhat_00001.1.el7eap
eap7-jboss-jsf (Red Hat package) - addressed in versions api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el7eap, api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el8eap, api_2.3_spec-3.0.0-8.SP08_redhat_00001.1.el9eap
eap7-wildfly-http-client (Red Hat package) - addressed in versions 1.1.17-1.Final_redhat_00002.1.el7eap, 1.1.17-1.Final_redhat_00002.1.el8eap, 1.1.17-1.Final_redhat_00002.1.el9eap
eap7-wildfly-transaction-client (Red Hat package) - addressed in versions 1.1.19-1.Final_redhat_00001.1.el7eap, 1.1.19-1.Final_redhat_00001.1.el8eap, 1.1.19-1.Final_redhat_00001.1.el9eap
eap7-log4j-jboss-logmanager (Red Hat package) - update to 1.2.2-2.Final_redhat_00002.1.el7eap
eap7-wildfly-discovery (Red Hat package) - addressed in versions 1.2.4-1.Final_redhat_00001.1.el7eap, 1.2.4-1.Final_redhat_00001.1.el8eap, 1.2.4-1.Final_redhat_00001.1.el9eap
eap7-h2database (Red Hat package) - addressed in versions 1.4.197-2.redhat_00005.1.ep7.el7, 1.4.197-3.redhat_00004.1.el7eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.7.2-12.Final_redhat_00013.1.el7eap, 1.10.0-36.Final_redhat_00035.1.el7eap, 1.10.0-36.Final_redhat_00035.1.el8eap, 1.10.0-36.Final_redhat_00035.1.el9eap
eap7-avro (Red Hat package) - addressed in versions 1.7.6-2.redhat_00003.1.ep7.el7, 1.7.6-8.redhat_00003.1.el7eap
eap7-jboss-modules (Red Hat package) - addressed in versions 1.12.3-3.Final_redhat_00001.1.el7eap, 1.12.3-3.Final_redhat_00001.1.el8eap, 1.12.3-3.Final_redhat_00001.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.23-2.Final_redhat_00001.1.el7eap, 1.15.23-2.Final_redhat_00001.1.el8eap, 1.15.23-2.Final_redhat_00001.1.el9eap
eap7-bouncycastle (Red Hat package) - update to 1.68.0-1.redhat_00005.1.ep7.el7
eap7-jboss-marshalling (Red Hat package) - addressed in versions 2.0.15-1.Final_redhat_00001.1.el7eap, 2.0.15-1.Final_redhat_00001.1.ep7.el7
eap7-xml-security (Red Hat package) - addressed in versions 2.2.3-2.redhat_00001.1.el7eap, 2.3.4-1.redhat_00002.1.el7eap, 2.3.4-1.redhat_00002.1.el8eap, 2.3.4-1.redhat_00002.1.el9eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.32-1.SP1_redhat_00001.1.el7eap, 2.2.32-1.SP1_redhat_00001.1.el8eap, 2.2.32-1.SP1_redhat_00001.1.el9eap
eap7-wss4j (Red Hat package) - addressed in versions 2.3.3-2.redhat_00001.1.el7eap, 2.4.3-1.redhat_00001.1.el7eap, 2.4.3-1.redhat_00001.1.el8eap, 2.4.3-1.redhat_00001.1.el9eap
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-26.redhat_00015.1.ep7.el7, 2.7.1-38.redhat_00015.1.el7eap
eap7-jackson-databind (Red Hat package) - update to 2.8.11.6-1.SP1_redhat_00001.1.ep7.el7
Red Hat Integration Camel Extensions for Quarkus - addressed in versions 2.13.9.SP2, 3.2.12.GA, 3.8.4.SP1
eap7-apache-cxf (Red Hat package) - addressed in versions 3.1.16-3.SP1_redhat_00001.1.ep7.el7, 3.4.10-1.SP1_redhat_00001.1.el7eap, 3.5.8-1.redhat_00001.1.el7eap, 3.5.8-1.redhat_00001.1.el8eap, 3.5.8-1.redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.22-1.Final_redhat_00001.1.el7eap, 3.3.22-1.Final_redhat_00001.1.el8eap, 3.3.22-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.5.10-1.Final_redhat_00001.1.ep7.el7, 3.7.13-1.Final_redhat_00001.1.el7eap
Red Hat Camel for Spring Boot - update to 3.20.6
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.54-3.Final_redhat_00001.1.el7eap, 4.0.54-3.Final_redhat_00001.1.el8eap, 4.0.54-3.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.1.8-2.GA_redhat_00002.1.ep7.el7, 7.3.11-4.GA_redhat_00002.1.el7eap, 7.4.17-2.GA_redhat_00002.1.el7eap, 7.4.17-2.GA_redhat_00002.1.el8eap, 7.4.17-2.GA_redhat_00002.1.el9eap
IBM QRadar Incident Forensics - update to 7.5.0.10
HPE Telco IP Mediation E-Media - update to 8.5.1
IBM Maximo Application Suite - addressed in versions 8.10.18, 8.11.15, 9.0.3, 9.1.0
eap7-infinispan (Red Hat package) - addressed in versions 11.0.19-2.Final_redhat_00001.1.el7eap, 11.0.19-2.Final_redhat_00001.1.el8eap, 11.0.19-2.Final_redhat_00001.1.el9eap
eap7-jboss-metadata (Red Hat package) - addressed in versions 13.5.0-1.Final_redhat_00001.1.el7eap, 13.5.0-1.Final_redhat_00001.1.el8eap, 13.5.0-1.Final_redhat_00001.1.el9eap

• https://lists.apache.org/thread/qxloowbsjdxz7d87o4shfh203j87yfsn

• SSRF in Apache CXF
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus
• Server-side request forgery in IBM Tivoli Application Dependency Discovery Manager
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus 3.8.4
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus 3.2.12
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 3.20
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Server-Side Request Forgery (SSRF) in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Server-Side Request Forgery (SSRF) in Oracle Communications Element Manager
• Multiple vulnerabilities in Oracle Commerce Platform
• Multiple vulnerabilities in Oracle WebCenter Forms Recognition
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in QRadar Incident Forensics
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in Red Hat Integration Camel-K
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
• Multiple vulnerabilities in HPE Telco IP Mediation Application
• Multiple vulnerabilities in IBM Data Virtualization on Cloud Pak for Data