PT-2024-25994 · Apache · Apache Xml Security For C++

Published 2024-06-26 · Updated 2024-08-08 · CVE-2024-34580

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache XML Security for C++ versions 2.0.4 and earlier

Description The issue is related to the implementation of the XML Signature Syntax and Processing (XMLDsig) specification, which lacks protection against an SSRF payload in a KeyInfo element. It is noted that the project disputes this issue, stating that any vulnerabilities are the result of a failure to configure XML Security for C++ securely. The library's use requires considerable additional code and a deep understanding of the standards and protocols involved to arrive at a secure implementation for any particular use case.

Recommendations For Apache XML Security for C++ versions 2.0.4 and earlier, consider avoiding direct use of this library due to the complexity and security concerns associated with its implementation. As a temporary workaround, consider restricting the use of the KeyInfo element to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-34580

Affected Products

Apache Xml Security For C++

References · 14

• 🔥 https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2024-21893.md · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-34580 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34580 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-34580 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-34580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34580 · Security Note
• https://ubuntu.com/security/CVE-2024-34580 · Vendor Advisory
• https://t.me/cvenotify/88432 · Telegram Post
• https://sonatype.com/blog/the-exploited-ivanti-connect-ssrf-vulnerability-stems-from-xmltooling-oss-library · Note
• https://t.me/cvenotify/84502 · Telegram Post
• https://santuario.apache.org/download.html · Note
• https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/3726671873/Santuario · Note
• https://cloud.google.com/blog/topics/threat-intelligence/apache-library-allows-server-side-request-forgery · Note
• https://lists.apache.org/thread/po2gocnw4gtf4boy5mmjb54g62qhbrl9 · Note