CVE-2023-36661 Server-side request forgery in n/a
Attackers can exploit a crafted KeyInfo element in Shibboleth XMLTooling to perform Server-Side Request Forgery, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-36661?
CVE-2023-36661 is a high-severity server-side request forgery vulnerability in Debian Debian Linux, published on 25 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)
Weakness: CWE-918
Which versions are affected by CVE-2023-36661?
It affects 2 products.
Linux distribution packages (16)
xmltooling SUSE:Enterprise Storage 7.1 | All versions | 3.1.0-150300.3.3.1 |
xmltooling SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 3.1.0-150300.3.3.1 |
xmltooling SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 3.1.0-150300.3.3.1 |
xmltooling SUSE:Linux Enterprise Module for Server Applications 15 SP4 | All versions | 3.1.0-150300.3.3.1 |
xmltooling SUSE:Linux Enterprise Module for Server Applications 15 SP5 | All versions | 3.1.0-150300.3.3.1 |
xmltooling SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 3.1.0-150300.3.3.1 |
xmltooling SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.5.6-3.13.1 |
xmltooling SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 3.1.0-150300.3.3.1 |
xmltooling SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.5.6-3.13.1 |
xmltooling SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 3.1.0-150300.3.3.1 |
xmltooling SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.5.6-3.13.1 |
xmltooling SUSE:Manager Proxy 4.2 | All versions | 3.1.0-150300.3.3.1 |
xmltooling SUSE:Manager Server 4.2 | All versions | 3.1.0-150300.3.3.1 |
xmltooling openSUSE:Leap 15.4 | All versions | 1.6.4-150000.3.10.1 |
xmltooling openSUSE:Leap 15.4 | All versions | 3.1.0-150300.3.3.1 |
xmltooling openSUSE:Leap 15.5 | All versions | 3.1.0-150300.3.3.1 |
Products include Debian Debian Linux, Shibboleth Xmltooling.
How do I fix CVE-2023-36661?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-36661 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36661 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2023-36661, DLA-3464-1, DSA-5432-1, GHSA-j522-236p-wx5g, SUSE-SU-2023:2766-1, SUSE-SU-2023:2975-1 and 3 more.