PT-2023-6524 · Apache+3 · Apache Axis+3

Letian Yuan · Published 2023-09-05 · Updated 2024-08-02 · CVE-2023-40743

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Axis versions prior to 1.4

Description The issue arises from insufficient input validation in the implementation of the Apache Axis web service platform, allowing potentially dangerous lookup mechanisms such as LDAP when looking up a service through ServiceFactory.getService. Passing untrusted input to this API method could expose the application to Denial of Service (DoS), Server-Side Request Forgery (SSRF), and even attacks leading to Remote Code Execution (RCE).

Recommendations As a temporary workaround, consider reviewing your code to verify no untrusted or unsanitized input is passed to ServiceFactory.getService. Migrate to a different SOAP engine, such as Apache Axis 2/Java, to fully resolve the issue. Apply the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 as an alternative workaround.

Fix

RCE

DoS

Weakness Enumeration

CWE-20

CWE-75

Related Identifiers

BDU:2023-07271

CVE-2023-40743

DLA-3622-1

GHSA-RMQP-9W4C-GC7W

USN-6470-1

Affected Products

Apache Axis

Astra Linux

Linuxmint

Ubuntu

References · 26

• https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 · Patch
• https://ubuntu.com/security/CVE-2023-40743 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-40743 · Security Note
• https://osv.dev/vulnerability/USN-6470-1 · Vendor Advisory
• https://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07271 · Security Note
• https://osv.dev/vulnerability/GHSA-rmqp-9w4c-gc7w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40743 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40743 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-40743 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-40743 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-40743 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6470-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3622-1 · Vendor Advisory
• https://github.com/apache/axis-axis1-java · Note