Server-Side Request Forgery (SSRF) Vulnerability in Apache XML Graphics Batik
Summary
CVE-2022-40146: Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. Affects batik across 2 version ranges.
< 1.12-4+deb11u3
< 6f03c1c80f51f53c61d506a544d810bfc111ec4f
Fixed in 1.12-4+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache XML Graphics Batik is a powerful toolkit for working with SVG (Scalable Vector Graphics) files. It provides a range of features for creating, manipulating, and rendering SVG content. However, it has been found to be vulnerable to a Server-Side Request Forgery (SSRF) attack, which can allow unauthorized access to files via Jar URLs, potentially exposing sensitive data.
Vulnerability Detail
The vulnerability, identified as CVE-2022-40146, arises from improper handling of Jar URLs within the Batik library. This SSRF vulnerability allows an attacker to craft requests that can access internal files on the server, leading to potential data leakage or unauthorized access to sensitive information. The issue affects versions of Batik prior to 1.15+dfsg-1, making it critical for users to update to the latest version to mitigate risks.
How To Fix
Minimum fixed version
1.12-4+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade batikTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not possible, consider restricting access to the affected services or implementing network-level controls to prevent unauthorized requests from reaching the server.
Conclusion
The CVE-2022-40146 vulnerability in Apache XML Graphics Batik poses a significant risk due to its potential for unauthorized file access. Users are strongly advised to upgrade to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for batik →
FAQ
CVE-2022-40146 is a Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik that allows attackers to access internal files using Jar URLs.
The vulnerability affects Apache XML Graphics Batik versions prior to 1.15+dfsg-1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2022-40146 is 7.5, indicating a high severity level.
If an immediate upgrade is not feasible, consider implementing network-level controls to restrict access to the affected services.
Related vulnerabilities
Recent vulnerabilities recorded for batik.
