CVE-2020-1925: Server-Side Request Forgery (SSRF) in Apache Olingo
Summary
CVE-2020-1925: Server-Side Request Forgery (SSRF) in Apache Olingo. Affects org.apache.olingo:odata-client-core versions >= 4.0.0, < 4.7.1. Fixed in 4.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Olingo is an open-source Java library that provides a framework for implementing OData (Open Data Protocol) services. It allows developers to build and consume RESTful APIs that adhere to the OData specifications. The library includes various components for handling OData requests and responses, such as parsing, validation, and serialization. However, versions 4.0.0 to 4.7.0 of Apache Olingo contain a vulnerability that can be exploited for Server-Side Request Forgery (SSRF) attacks.
Vulnerability Detail
The vulnerability in Apache Olingo arises from the AsyncRequestWrapperImpl class, which is responsible for processing HTTP requests asynchronously. This class reads a URL from the Location header and subsequently sends a GET or DELETE request to that URL. An attacker can exploit this behavior by tricking a client into connecting to a malicious server. Once connected, the malicious server can make the client call any URL, including internal resources that are not directly accessible to the attacker. This SSRF attack can potentially lead to unauthorized access to sensitive information or services within the affected system.
How To Fix
Minimum fixed version
4.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to Apache Olingo version 4.7.1 or later.
Conclusion
The SSRF vulnerability in Apache Olingo versions 4.0.0 to 4.7.0 can be exploited by an attacker to make a client perform unauthorized HTTP requests to internal resources. To mitigate this vulnerability, it is crucial to upgrade to Apache Olingo version 4.7.1 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.olingo:odata-client-core →
FAQ
Apache Olingo is an open-source Java library for building and consuming RESTful APIs that adhere to the OData specifications.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make a server perform arbitrary HTTP requests on behalf of the attacker, potentially accessing internal resources or services that are not directly accessible to the attacker.
The vulnerability in Apache Olingo allows an attacker to trick a client into connecting to a malicious server. Once connected, the malicious server can make the client call any URL, including internal resources that are not directly accessible to the attacker.
Exploiting the SSRF vulnerability in Apache Olingo can lead to unauthorized access to sensitive information or services within the affected system. This can result in data breaches, privilege escalation, or further compromise of the system.
To fix the vulnerability, you should upgrade to Apache Olingo version 4.7.1 or later. This version includes a fix for the SSRF vulnerability in the AsyncRequestWrapperImpl class.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.olingo:odata-client-core.
