CVE-2022-40146 Jar url should be blocked by DefaultScriptSecurity

What is CVE-2022-40146?

CVE-2022-40146 is a high-severity server-side request forgery vulnerability in Debian Debian Linux, published on 22 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Weakness: CWE-918

Which versions are affected by CVE-2022-40146?

2 open source packages ship an affected version, including org.apache.xmlgraphics:batik. It affects 2 products.

Products include Apache Batik, Debian Debian Linux.

How do I fix CVE-2022-40146?

Upgrade org.apache.xmlgraphics:batik to 1.15 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-40146 being exploited?

There is no known exploitation of CVE-2022-40146 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Other vulnerabilities in Debian Debian Linux

• CVE-2018-8013 Deserialization of Untrusted Data in Apache Batik Critical 9.8
• CVE-2020-11987 Server-side request forgery (SSRF) in Apache Batik High 8.2
• CVE-2022-41704 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input High 7.5
• CVE-2022-42890 Apache Batik prior to 1.16 allows RCE via scripting High 7.5
• CVE-2019-17566 Server-side request forgery (SSRF) in Apache Batik High 7.5

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2022-40146, GHSA-h4qg-p7r2-cpg3, UBUNTU-CVE-2022-40146.