cnvd - cnvd-2023-70275

cnvd-2023-70275

Vulnerability from cnvd

Title: Apache Axis输入验证错误漏洞

Description:

Apache Axis是美国阿帕奇（Apache）基金会的一个开源、基于XML的Web服务架构。该产品包含了Java和C++语言实现的SOAP服务器，以及各种公用服务及API，以生成和部署Web服务应用。

Apache Axis存在输入验证错误漏洞，该漏洞源于将不受信任的输入传递给ServiceFactory.getService方法时程序未能正确处理，攻击者可利用该漏洞会使应用程序遭受DoS、SSRF甚至导致RCE的攻击。

Severity: 高

Patch Name: Apache Axis输入验证错误漏洞的补丁

Patch Description:

Apache Axis存在输入验证错误漏洞，该漏洞源于将不受信任的输入传递给ServiceFactory.getService方法时程序未能正确处理，攻击者可利用该漏洞会使应用程序遭受DoS、SSRF甚至导致RCE的攻击。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82

Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-40743

Impacted products

Name
Apache Axis <2023-08-01

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-40743",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-40743"
    }
  },
  "description": "Apache Axis\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u5f00\u6e90\u3001\u57fa\u4e8eXML\u7684Web\u670d\u52a1\u67b6\u6784\u3002\u8be5\u4ea7\u54c1\u5305\u542b\u4e86Java\u548cC++\u8bed\u8a00\u5b9e\u73b0\u7684SOAP\u670d\u52a1\u5668\uff0c\u4ee5\u53ca\u5404\u79cd\u516c\u7528\u670d\u52a1\u53caAPI\uff0c\u4ee5\u751f\u6210\u548c\u90e8\u7f72Web\u670d\u52a1\u5e94\u7528\u3002\n\nApache Axis\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5c06\u4e0d\u53d7\u4fe1\u4efb\u7684\u8f93\u5165\u4f20\u9012\u7ed9ServiceFactory.getService\u65b9\u6cd5\u65f6\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5904\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f1a\u4f7f\u5e94\u7528\u7a0b\u5e8f\u906d\u53d7DoS\u3001SSRF\u751a\u81f3\u5bfc\u81f4RCE\u7684\u653b\u51fb\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-70275",
  "openTime": "2023-09-20",
  "patchDescription": "Apache Axis\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u5f00\u6e90\u3001\u57fa\u4e8eXML\u7684Web\u670d\u52a1\u67b6\u6784\u3002\u8be5\u4ea7\u54c1\u5305\u542b\u4e86Java\u548cC++\u8bed\u8a00\u5b9e\u73b0\u7684SOAP\u670d\u52a1\u5668\uff0c\u4ee5\u53ca\u5404\u79cd\u516c\u7528\u670d\u52a1\u53caAPI\uff0c\u4ee5\u751f\u6210\u548c\u90e8\u7f72Web\u670d\u52a1\u5e94\u7528\u3002\r\n\r\nApache Axis\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5c06\u4e0d\u53d7\u4fe1\u4efb\u7684\u8f93\u5165\u4f20\u9012\u7ed9ServiceFactory.getService\u65b9\u6cd5\u65f6\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5904\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4f1a\u4f7f\u5e94\u7528\u7a0b\u5e8f\u906d\u53d7DoS\u3001SSRF\u751a\u81f3\u5bfc\u81f4RCE\u7684\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Axis\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apache Axis \u003c2023-08-01"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-40743",
  "serverity": "\u9ad8",
  "submitTime": "2023-09-11",
  "title": "Apache Axis\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2023-40743 (GCVE-0-2023-40743)

Vulnerability from cvelistv5

Published

2023-09-05 14:42

Modified

2025-02-13 17:08

Severity ?

CWE

CWE-20 - Improper Input Validation

Summary

** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.

References

▼	URL	Tags
	https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210	patch
	https://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/10/msg00025.html

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Axis	Version: 0 ≤ 1.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "axis",
            "vendor": "apache",
            "versions": [
              {
                "lessThanOrEqual": "1.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-40743",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-18T15:52:10.693216Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-75",
                "description": "CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-18T15:52:14.786Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:46:10.378Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00025.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Axis",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Letian Yuan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through \"ServiceFactory.getService\" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to \"ServiceFactory.getService\", or by applying the patch from \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210\"\u003ehttps://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210\u003c/a\u003e. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through \"ServiceFactory.getService\" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE.\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to \"ServiceFactory.getService\", or by applying the patch from  https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-17T14:06:14.621Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00025.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-40743",
    "datePublished": "2023-09-05T14:42:13.317Z",
    "dateReserved": "2023-08-21T12:06:59.659Z",
    "dateUpdated": "2025-02-13T17:08:43.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted