CVE-2022-45378: Apache SOAP Unauthenticated RPCRouterServlet
Summary
CVE-2022-45378: Apache SOAP contains unauthenticated RPCRouterServlet. Affects soap:soap versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache SOAP is an open-source Java implementation of the SOAP (Simple Object Access Protocol) protocol. It provides a framework for building web services and allows communication between different applications over a network. The SOAP package, specifically the RPCRouterServlet, is affected by a critical vulnerability that allows unauthenticated access. This means that an attacker can invoke methods on the classpath without proper authentication. Depending on the classes available, this could potentially lead to arbitrary remote code execution.
Vulnerability Detail
The vulnerability in Apache SOAP arises from the default configuration of the RPCRouterServlet, which lacks authentication. This allows an attacker to exploit the SOAP service and invoke methods on the classpath that meet certain criteria. The impact of this vulnerability can be severe, as it may result in arbitrary remote code execution. It is important to note that this vulnerability only affects products that are no longer supported by the maintainer.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if upgrading or migrating to a supported version is not feasible, it is recommended to disable or restrict access to the RPCRouterServlet. This can be achieved by modifying the configuration or deployment settings of the SOAP service. Consult the documentation or support resources for the specific SOAP implementation being used for detailed instructions on how to implement this workaround.
Conclusion
The Apache SOAP Unauthenticated RPCRouterServlet vulnerability poses a significant risk to systems that are no longer supported by the maintainer. Upgrading to a supported version or migrating to an alternative SOAP implementation is strongly recommended. Regularly updating and patching software is crucial to mitigate the risk of known vulnerabilities. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for soap:soap →
FAQ
This vulnerability affects products that are no longer supported by the maintainer. It is recommended to upgrade to a supported version or consider migrating to an alternative SOAP implementation.
The impact of this vulnerability can be severe, as it may lead to arbitrary remote code execution. Attackers can exploit the unauthenticated RPCRouterServlet to invoke methods on the classpath, potentially compromising the entire system.
The recommended mitigation is to upgrade to a supported version of Apache SOAP or migrate to an alternative SOAP implementation. Regularly updating and patching software is also crucial to mitigate the risk of known vulnerabilities.
Yes, this vulnerability can be exploited remotely. Attackers can access the unauthenticated RPCRouterServlet over a network and invoke methods on the classpath, potentially leading to arbitrary remote code execution.
Yes, the CVSS score for this vulnerability is 9.8, indicating its critical severity.
Related vulnerabilities
Recent vulnerabilities recorded for soap:soap.
