CVE-2024-12801 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks
Attackers can forge server-side requests by modifying XML configuration files in the logback logging library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-12801?
CVE-2024-12801 is a low-severity server-side request forgery vulnerability in QOS.CH Sarl logback, published on 19 Dec 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.
The attacks involves the modification of DOCTYPE declaration in XML configuration files.
Weakness: CWE-918
Which versions are affected by CVE-2024-12801?
4 open source packages ship an affected version, including ch.qos.logback:logback-core.
| Package | Affected | Fixed in |
|---|---|---|
ch.qos.logback:logback-core Maven | All versions | 1.3.15 |
ch.qos.logback:logback-core Maven | All versions | 1.3.15 |
ch.qos.logback:logback-core Maven | From 1.4.0 | 1.5.13 |
ch.qos.logback:logback-core Maven | From 1.4.0 | 1.5.13 |
How do I fix CVE-2024-12801?
Upgrade ch.qos.logback:logback-core to a fixed version for your release line: 1.3.15 or 1.5.13.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-12801 being exploited?
There is no known exploitation of CVE-2024-12801 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-JN57068, CLEANSTART-2026-LN17304, DEBIAN-CVE-2024-12801, ECHO-90aa-b1f3-d3e8, GHSA-6v67-2wr5-gvf4, MINI-2m8q-4w38-9mff and 11 more.