Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 23 Nov 2015 15:17:09 +0100
From: "Christofer Dutz" <cdutz@...che.org>
To: dev@...x.apache.org, "users@...x.apache.org" <users@...x.apache.org>,
 security@...che.org, oss-security@...ts.openwall.com,
 bugtraq@...urityfocus.com
Subject: CVE-2015-5255: SSRF vulnerability in Apache Flex BlazeDS 4.7.1 

CVE-2015-5255: SSRF vulnerability in Apache Flex BlazeDS 4.7.1
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected: BlazeDS 4.7.0 and 4.7.1
Description: The code in BlazeDS to deserialize AMF XML datatypes allows
so-called SSRF Attacks
(Server Side Request Forgery) in which the server could contact a remote
service on
behalf of the attacker. The attacker could hereby circumvent firewall
restrictions.
Mitigation: 4.7.x users should upgrade to 4.7.2
Example: For XML object containing the following string representation:

<!DOCTYPE foo PUBLIC "-//VSR//PENTEST//EN"
"http://protected-server/protected-service"><foo>Some content</foo>
The server could access the url:
http://protected-server/protected-service

Even if directly accessing this resource is prevented by firewall rules.

Credit: This issue was discovered by ´╗┐James Kettle of PortSwigger Ltd.
References:
http://www.vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf

Christofer Dutz

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.