Direct Request Information Disclosure in Apache Axis2/Java

Executive Summary

This is a Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java where metadata about services could be exposed even when disabled. The exposeServiceMetadata parameter only blocked certain metadata routes like ?wsdl, ?wsdl2 and ?xsd. Other routes such as file paths, named-WSDL, OpenAPI, Swagger UI, services listing, WS-MetadataExchange and ping module still revealed metadata to anonymous users, including operation names and schemas.

Useful 0 Not Useful 0

Detection Guidance

Check Apache Axis2/Java services for exposed metadata by accessing routes like /services/, ?wsdl, ?wsdl2, ?xsd, or WS-MetadataExchange endpoints. Hidden services may reveal operation names or schemas if metadata is exposed. Use tools like curl to query these endpoints and verify if sensitive data is accessible.

Useful 0 Not Useful 0

Impact Analysis

Attackers could access sensitive metadata about your services without authentication. This includes operation names, request and response schemas, and potentially other internal details. While not a direct code execution risk, it could aid attackers in crafting more sophisticated attacks against your services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive information, potentially violating GDPR's data protection principles or HIPAA's requirements for protecting health information. The exposure of service metadata might reveal details about data processing that should remain confidential under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Apache Axis2/Java to version 2.0.2 or later to enforce the exposeServiceMetadata parameter uniformly across all routes. This prevents metadata leakage from hidden services and secures file access paths.

Useful 0 Not Useful 0