CVE-2022-40705: Apache SOAP's RPCRouterServlet allows reading of arbitrary files over HTTP
Summary
CVE-2022-4070: Insufficient Session Expiration in librenms/librenms. Affects librenms/librenms versions < 22.10.0. Fixed in 22.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache SOAP is an open-source Java implementation of the Simple Object Access Protocol (SOAP). It provides a framework for building web services using XML-based messaging. The RPCRouterServlet is a component of Apache SOAP that handles remote procedure calls (RPC) over HTTP. It allows clients to invoke methods on server-side objects remotely. However, a vulnerability in the RPCRouterServlet allows an attacker to read arbitrary files over HTTP, leading to potential unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2022-40705, is an Improper Restriction of XML External Entity Reference (XXE) vulnerability. By exploiting this flaw, an attacker can craft a malicious XML payload that includes external entity references pointing to arbitrary files on the server. When the RPCRouterServlet processes this payload, it resolves the external entities and includes the contents of the referenced files in the response. This allows the attacker to read sensitive files, such as configuration files or user data, that should not be accessible over HTTP. The vulnerability affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
22.10.0
This is the first release that contains the fix.
composer require librenms/librenms:22.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is possible to modify the server configuration to block access to the RPCRouterServlet or restrict access to specific IP addresses. This can be achieved by configuring the web server or application server hosting Apache SOAP to deny requests to the RPCRouterServlet URL or by using firewall rules to block incoming connections to the server from unauthorized sources. However, this workaround may impact the functionality of legitimate clients that rely on the RPCRouterServlet for remote procedure calls.
Conclusion
In conclusion, CVE-2022-40705 is a high-severity vulnerability in Apache SOAP's RPCRouterServlet that allows an attacker to read arbitrary files over HTTP. It is crucial to upgrade to a supported version of Apache SOAP or consider alternative SOAP implementations to mitigate this vulnerability. Additionally, server configurations should be reviewed and updated to restrict access to sensitive files and directories. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
Apache SOAP is an open-source Java implementation of the Simple Object Access Protocol (SOAP), which provides a framework for building web services using XML-based messaging.
The RPCRouterServlet is a component of Apache SOAP that handles remote procedure calls (RPC) over HTTP. It allows clients to invoke methods on server-side objects remotely.
An XML External Entity (XXE) vulnerability is a type of security flaw that allows an attacker to include external entities in XML documents, which can lead to various attacks, including reading arbitrary files on the server.
An attacker can exploit this vulnerability by crafting a malicious XML payload that includes external entity references pointing to arbitrary files on the server. When the RPCRouterServlet processes this payload, it resolves the external entities and includes the contents of the referenced files in the response, allowing the attacker to read sensitive information.
The vulnerability allows an attacker to read arbitrary files over HTTP, potentially leading to unauthorized access to sensitive information stored on the server. This can include configuration files, user data, or any other files that should not be accessible over the network.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
