CVE-2020-11980: Server-Side Request Forgery in Karaf
Summary
CVE-2020-11980: Server-Side Request Forgery in Karaf. Affects org.apache.karaf.management:org.apache.karaf.management.server versions < 4.2.9. Fixed in 4.2.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Karaf is an open-source OSGi-based runtime container for deploying and managing applications. It provides a lightweight and flexible platform for building and running Java applications. Karaf uses JMX authentication and authorization for managing MBeans. By default, only an 'admin' role can invoke MBeans. However, there is a vulnerability that allows users with a 'viewer' role to perform SSRF-style attacks and pollute the MBean registry, potentially escalating privileges. This vulnerability has a CVSS score of 6.3.
Vulnerability Detail
The vulnerability in Karaf arises from the 'etc/jmx.acl.cfg' file, which allows users with a 'viewer' role to call the get* method. An attacker can authenticate as a 'viewer' role and invoke the getMBeansFromURL method, which fetches MBeans from a remote server and registers them in Karaf. Although the attacker cannot invoke on the MBean due to lack of permission, this SSRF-style attack can still be used to access external resources and pollute the MBean registry. The impact of this vulnerability can be mitigated by adding ACLs to limit access. Users should update to Apache Karaf 4.2.9 or newer to fix this vulnerability.
How To Fix
Latest published version: 4.4.12 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can modify the 'etc/jmx.acl.cfg' file to restrict access to the get* method for the 'viewer' role. By adding specific ACL rules, the vulnerability can be mitigated. Here is an example of how to modify the 'etc/jmx.acl.cfg' file:
viewer = get*
admin = *
Conclusion
The vulnerability in Apache Karaf allows users with a 'viewer' role to perform SSRF-style attacks and pollute the MBean registry. By updating to Apache Karaf 4.2.9 or newer, users can mitigate this vulnerability and improve access control for MBeans. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.karaf.management:org.apache.karaf.management.server →
FAQ
Apache Karaf is an open-source OSGi-based runtime container for deploying and managing applications. It provides a lightweight and flexible platform for building and running Java applications.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests from a vulnerable server to internal or external resources. In this case, the SSRF vulnerability in Karaf allows a user with a 'viewer' role to access external resources and pollute the MBean registry.
The impact of this vulnerability is relatively low as it requires a user with a 'viewer' role to exploit it. However, it can be used for SSRF-style attacks and privilege escalation by polluting the MBean registry. By updating to Apache Karaf 4.2.9 or newer, users can mitigate this vulnerability.
To fix this vulnerability, users should update their Apache Karaf installation to version 4.2.9 or newer. This update includes security patches that address the SSRF vulnerability and improve access control for MBeans.
For more information about Apache Karaf security updates, users can visit the official Apache Karaf website or refer to the release notes and documentation provided by the Apache Karaf community.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.karaf.management:org.apache.karaf.management.server.
