Server-Side Request Forgery Information Disclosure Vulnerability

Vulnerability

CVE-2022-38398 is a Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik 1.14. The issue arises because the DefaultExternalResourceSecurity class does not block the jar: protocol when loading external resources. This allows an attacker to craft SVG files that reference URLs using the jar: scheme, which Batik will fetch without proper validation [1][2].

Exploitation

An attacker can exploit this vulnerability by supplying a malicious SVG document to a Batik-based application (e.g., SVG viewer, converter, or server-side rendering engine). No authentication or special privileges are required; the attack only requires the application to process the crafted SVG. The jar: protocol can be used to access remote resources, potentially reaching internal networks or local file system paths [1].

Impact

Successful exploitation allows an attacker to perform SSRF, enabling them to scan internal networks, access cloud metadata endpoints, or retrieve sensitive files if the Batik instance has sufficient permissions. This could lead to information disclosure and further compromise of internal services [1][4].

Mitigation

The vulnerability is fixed in Apache Batik version 1.15, where the jar: protocol is blocked by default. Users are strongly advised to upgrade to Batik 1.15 or later. No workaround is available for earlier versions [2][4].