CVE-2018-17198 Server-side request forgery in Apache Roller
Attackers can exploit SSRF and file enumeration via XML-RPC interface, even if disabled in UI, by leveraging Java SAX parser external entity support.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-17198?
CVE-2018-17198 is a critical server-side request forgery vulnerability in Apache Roller, published on 28 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external entities in XML DOCTYPE, which opens Roller up to SSRF / File Enumeration vulnerability. Note that this vulnerability exists even if Roller XML-RPC interface is disable via the Roller web admin UI. Mitigation: There are a couple of ways you can fix this vulnerability: 1) Upgrade to the latest version of Roller, which is now 5.2.2 2) Or, edit the Roller web.xml file and comment out the XML-RPC Servlet mapping as shown below: <!-- <servlet-mapping> <servlet-name>XmlRpcServlet</servlet-name> <url-pattern>/roller-services/xmlrpc</url-pattern> </servlet-mapping> -->
Weakness: CWE-918
Which versions are affected by CVE-2018-17198?
It affects 1 product.
Products include Apache Roller.
How do I fix CVE-2018-17198?
No fix has been published for CVE-2018-17198 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2018-17198 being exploited?
There is no known exploitation of CVE-2018-17198 in the wild and no public exploit code.
Other vulnerabilities in Apache Roller
Sources
Also known as GHSA-38f5-5m8x-c6h5.