CVE-2020-11987 Server-side request forgery (SSRF) in Apache Batik
An attacker can exploit improper input validation in Apache Batik to force the server to make arbitrary GET requests, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11987?
CVE-2020-11987 is a high-severity server-side request forgery vulnerability in Debian Debian Linux, published on 24 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Which versions are affected by CVE-2020-11987?
2 open source packages ship an affected version, including org.apache.xmlgraphics:batik-svgbrowser. It affects 22 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.xmlgraphics:batik-svgbrowser Maven | All versions | 1.14 |
org.apache.xmlgraphics:batik-svgbrowser Maven | All versions | 1.14 |
Products include Apache Batik, Debian Debian Linux, Fedoraproject Fedora, Oracle Agile Engineering Data Management, Oracle Banking Apis, Oracle Banking Digital Experience and 16 more.
How do I fix CVE-2020-11987?
Upgrade org.apache.xmlgraphics:batik-svgbrowser to 1.14 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-11987 being exploited?
There is no known exploitation of CVE-2020-11987 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2018-8013 Deserialization of Untrusted Data in Apache Batik
- CVE-2022-41704 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
- CVE-2022-42890 Apache Batik prior to 1.16 allows RCE via scripting
- CVE-2022-40146 Jar url should be blocked by DefaultScriptSecurity
- CVE-2019-17566 Server-side request forgery (SSRF) in Apache Batik
Sources
Also known as DEBIAN-CVE-2020-11987, GHSA-2h63-qp69-fwvw, MGASA-2021-0139, OESA-2021-1134, UBUNTU-CVE-2020-11987, openSUSE-SU-2024:12402-1.