CVE-2022-29631 Server-Side Request Forgery in Jodd HTTP
Attackers can perform Server-Side Request Forgery via CRLF injection in Jodd HTTP library requests, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29631?
CVE-2022-29631 is a high-severity server-side request forgery vulnerability in n/a, published on 6 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.
Weakness: CWE-74
Which versions are affected by CVE-2022-29631?
2 open source packages ship an affected version, including org.jodd:jodd-http. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jodd:jodd-http Maven | From 5.0.0 | 6.2.1 |
org.jodd:jodd-http Maven | From 5.0.0 | 6.2.1 |
Products include Jodd Jodd Http.
How do I fix CVE-2022-29631?
Upgrade org.jodd:jodd-http to 6.2.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-29631 being exploited?
There is no known exploitation of CVE-2022-29631 in the wild and no public exploit code.
Sources
Also known as GHSA-pp3c-cf6j-m3ff.