CVE-2022-38398: Apache Batik Server-Side Request Forgery

org.apache.xmlgraphics:batik Updated 02 Oct 2025

Summary

23/09/2022

Disclosed on

CVE-2022-38398

CVE

Yes i

Fix available

Moderate

Severity

5.3

CVSS Score

CVE-2022-38398: Apache Batik Server-Side Request Forgery. Affects org.apache.xmlgraphics:batik versions >= 1.0, < 1.15. Fixed in 1.15. How to fix ↓

Also tracked for

batik · Debian:11

The same CVE-2022-38398 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Batik is an open-source Java-based toolkit for applications that handle SVG (Scalable Vector Graphics) content. It provides a set of APIs and utilities for parsing, manipulating, and rendering SVG images. The vulnerability identified as CVE-2022-38398 affects Apache XML Graphics Batik version 1.14. This vulnerability allows an attacker to exploit a Server-Side Request Forgery (SSRF) flaw in Batik, enabling them to load a URL through the jar protocol.

Vulnerability Detail

The Server-Side Request Forgery (SSRF) vulnerability in Apache Batik allows an attacker to manipulate the application to make unauthorized requests to internal resources or external systems. By leveraging the jar protocol, an attacker can bypass security measures and potentially access sensitive information or perform actions on behalf of the application. This vulnerability has a CVSS score of 5.3, indicating a moderate severity level.

How To Fix

Minimum fixed version

1.15

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, developers can implement input validation and filtering to prevent the application from accepting malicious URLs. This can be done by checking the URL scheme and ensuring that only allowed protocols are accepted. Here is an example in Java:

import java.net.URL;

public class URLValidator {
  public static boolean isValidURL(String url) {
    try {
      URL validatedURL = new URL(url);
      String protocol = validatedURL.getProtocol();
      return protocol.equals("http") || protocol.equals("https");
    } catch (Exception e) {
      return false;
    }
  }
}

Conclusion

In conclusion, the Apache Batik Server-Side Request Forgery (CVE-2022-38398) vulnerability allows an attacker to exploit the jar protocol to make unauthorized requests. It is crucial to upgrade to Apache XML Graphics Batik version 1.15 or later to mitigate this vulnerability. Implementing input validation and filtering can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.xmlgraphics:batik →