CVE-2024-34580 Server-side request forgery in n/a
An SSRF vulnerability in Apache XML Security for C++ allows attackers to exploit KeyInfo elements, though the project disputes this as a configuration issue.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-34580?
CVE-2024-34580 is a medium-severity server-side request forgery vulnerability in n/a, published on 26 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload in a KeyInfo element. NOTE: the project disputes this CVE Record on the grounds that any vulnerabilities are the result of a failure to configure XML Security for C++ securely. Even when avoiding this particular issue, any use of this library would need considerable additional code and a deep understanding of the standards and protocols involved to arrive at a secure implementation for any particular use case. We recommend against continued direct use of this library.
Weakness: CWE-918
Which versions are affected by CVE-2024-34580?
How do I fix CVE-2024-34580?
No fix has been published for CVE-2024-34580 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-34580 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34580 exists.
Sources
Also known as GHSA-j4fv-r5w9-h675, UBUNTU-CVE-2024-34580.