CVE-2019-17566 Server-side request forgery (SSRF) in Apache Batik
Attackers can exploit improper input validation in Apache Batik to force the server to make arbitrary GET requests, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-17566?
CVE-2019-17566 is a high-severity server-side request forgery vulnerability in Oracle Business Intelligence, published on 12 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Weakness: CWE-918
Which versions are affected by CVE-2019-17566?
2 open source packages ship an affected version, including org.apache.xmlgraphics:batik. It affects 18 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.xmlgraphics:batik Maven | All versions | 1.13 |
org.apache.xmlgraphics:batik Maven | All versions | 1.13 |
Linux distribution packages (5)
xmlgraphics-batik SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 1.8-3.3.1 |
xmlgraphics-batik SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.8-3.3.1 |
xmlgraphics-batik SUSE:Package Hub 15 SP1 | All versions | 1.9-bp151.2.3.1 |
xmlgraphics-batik openSUSE:Leap 15.1 | All versions | 1.9-lp151.6.3.1 |
xmgraphics-batik openSUSE:Tumbleweed | All versions | 1.14-2.5 |
Products include Apache Batik, Oracle Api Gateway, Oracle Business Intelligence, Oracle Communications Application Session Controller, Oracle Communications Metasolv Solution, Oracle Communications Offline Mediation Controller and 12 more.
How do I fix CVE-2019-17566?
Upgrade org.apache.xmlgraphics:batik to 1.13 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2019-17566 being exploited?
There is no known exploitation of CVE-2019-17566 in the wild and no public exploit code.
Other vulnerabilities in Oracle Business Intelligence
- CVE-2018-8013 Deserialization of Untrusted Data in Apache Batik
- CVE-2020-11987 Server-side request forgery (SSRF) in Apache Batik
- CVE-2022-41704 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
- CVE-2022-42890 Apache Batik prior to 1.16 allows RCE via scripting
- CVE-2022-40146 Jar url should be blocked by DefaultScriptSecurity
Sources
Also known as DEBIAN-CVE-2019-17566, GHSA-cmx4-p4v5-hmr5, SUSE-SU-2020:1800-1, UBUNTU-CVE-2019-17566, openSUSE-SU-2020:0851-1, openSUSE-SU-2020:1043-1 and 1 more.