CVE-2022-4725 AWS SDK XML Parser XpathUtils.java XpathUtils server-side request forgery
An attacker can exploit a server-side request forgery vulnerability in the AWS SDK XML parser to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-4725?
CVE-2022-4725 is a medium-severity server-side request forgery vulnerability in AWS SDK, published on 24 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 is able to address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability.
Weakness: CWE-918
Which versions are affected by CVE-2022-4725?
2 open source packages ship an affected version, including com.amazonaws:aws-android-sdk-mobile-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.amazonaws:aws-android-sdk-mobile-client Maven | All versions | 2.59.1 |
com.amazonaws:aws-android-sdk-mobile-client Maven | All versions | 2.59.1 |
Products include Amazon Aws Software Development Kit.
How do I fix CVE-2022-4725?
Upgrade com.amazonaws:aws-android-sdk-mobile-client to 2.59.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-4725 being exploited?
There is no known exploitation of CVE-2022-4725 in the wild and no public exploit code.
Other vulnerabilities in AWS SDK
- CVE-2018-19981 Information disclosure in n/a
- CVE-2026-19642 Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp
- CVE-2026-19643 Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms
- CVE-2023-51651 Potential URI resolution path traversal in the AWS SDK for PHP
- CVE-2022-2582 Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go
Sources
Also known as GHSA-f5h9-qx38-2hgp.