PT-2020-15171 · Apache · Apache Olingo

Artem Smotrakov · Published 2020-01-09 · Updated 2020-02-04 · CVE-2020-1925

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Olingo versions 4.0.0 through 4.7.0

Description The issue allows for a potential Server-Side Request Forgery (SSRF) attack. This occurs because the AsyncRequestWrapperImpl class reads a URL from the Location header and then sends a GET or DELETE request to this URL. An attacker could trick a client into connecting to a malicious server, which could then make the client call any URL, including internal resources that are not directly accessible to the attacker.

Recommendations For Apache Olingo versions 4.0.0 through 4.7.0, consider restricting access to the AsyncRequestWrapperImpl class until a patch is available, or implement validation on the URLs read from the Location header to prevent requests to internal or unauthorized resources.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-1925

GHSA-V4QH-6367-4CX2

Affected Products

Apache Olingo

References · 4

• https://osv.dev/vulnerability/CVE-2020-1925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1925 · Security Note
• https://osv.dev/vulnerability/GHSA-v4qh-6367-4cx2 · Vendor Advisory
• https://mail-archives.apache.org/mod_mbox/olingo-user/202001.mbox/%3CCAGSZ4d6HwpF2woOrZJg_d0SkHytXJaCtAWXa3ZtBn33WG0YFvw%40mail.gmail.com%3E · Patch