Log in Start free

Vulnerability · Published Sep 5, 2023 · Assigned by apache

CVE-2023-40743Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

Critical 9.8

In plain English

A critical-severity improper input validation in Apache Axis from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)3.3%top 11.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12axis1.4-28+deb12u1DEBIAN-CVE-2023-40743
Debian:13axis1.4-29DEBIAN-CVE-2023-40743
Debian:14axis1.4-29DEBIAN-CVE-2023-40743
Mavenaxis:axisno fix listedGHSA-rmqp-9w4c-gc7w
Mavenorg.apache.axis:axisno fix listedGHSA-rmqp-9w4c-gc7w
Ubuntu:22.04:LTSaxis1.4-28+deb10u1build0.22.04.1USN-6470-1
Ubuntu:22.04:LTSaxis1.4-28+deb10u1build0.22.04.1UBUNTU-CVE-2023-40743

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Axis 0 – through 1.3

Weakness: CWE-20, CWE-75 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References