CVE-2014-3648 Server-side request forgery in Jboss Aerogear
Attackers can exploit user-controlled device tokens to trigger Server-Side Request Forgery, enabling denial of service or using the server as an anonymizer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-3648?
CVE-2014-3648 is a high-severity server-side request forgery vulnerability in Jboss Aerogear, published on 1 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached or can slow the server down by purposefully wasting it's time with slow endpoints. Similarly, one can provide whatever HTTP end point they want. This turns the server into a DDOS vector or an anonymizer for the posting of malware and so on.
Weakness: CWE-400
Which versions are affected by CVE-2014-3648?
It affects 1 product.
Products include Redhat Jboss Aerogear.
How do I fix CVE-2014-3648?
No fix has been published for CVE-2014-3648 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2014-3648 being exploited?
There is no known exploitation of CVE-2014-3648 in the wild and no public exploit code.
Other vulnerabilities in Jboss Aerogear
Sources
Also known as GHSA-jh99-8qr7-cf7m.