Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 23 Nov 2015 15:17:09 +0100
From: "Christofer Dutz" <>
To:, "" <>,,,
Subject: CVE-2015-5255: SSRF vulnerability in Apache Flex BlazeDS 4.7.1 

CVE-2015-5255: SSRF vulnerability in Apache Flex BlazeDS 4.7.1
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected: BlazeDS 4.7.0 and 4.7.1
Description: The code in BlazeDS to deserialize AMF XML datatypes allows
so-called SSRF Attacks
(Server Side Request Forgery) in which the server could contact a remote
service on
behalf of the attacker. The attacker could hereby circumvent firewall
Mitigation: 4.7.x users should upgrade to 4.7.2
Example: For XML object containing the following string representation:

"http://protected-server/protected-service"><foo>Some content</foo>
The server could access the url:

Even if directly accessing this resource is prevented by firewall rules.

Credit: This issue was discovered by ´╗┐James Kettle of PortSwigger Ltd.

Christofer Dutz

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ