Apache CXF SSRF Vulnerability

The vulnerability is a server-side request forgery (SSRF) in Apache CXF's handling of MTOM (SOAP Message Transmission Optimization Mechanism) requests. Specifically, when parsing the href attribute of XOP:Include elements, the software does not properly validate the URI, allowing an attacker to control the target of a subsequent HTTP request [1][2].

To exploit this, the attacker must send a crafted SOAP message with MTOM attachments containing a malicious XOP:Include href pointing to an internal or external resource. The web service must accept at least one parameter of any type. The vulnerability exists in versions before 3.5.5 and 3.4.10 [2].

Successful exploitation allows an attacker to perform SSRF attacks, potentially accessing internal systems, scanning internal networks, or interacting with cloud metadata endpoints, bypassing firewalls and access controls.

The Apache CXF project has released fixed versions 3.5.5 and 3.4.10. Users should upgrade to these versions to mitigate the vulnerability [2]. No known exploits are publicly reported.