Apicurio Registry SSRF via WSDL Import in FULL Validity Mode

Executive Summary

This vulnerability exists in Apicurio Registry where the WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature.

When the VALIDITY rule is set to FULL, an attacker who has Developer-role access can upload a WSDL document that contains attacker-controlled import locations.

This causes the registry to make HTTP requests to arbitrary internal URLs, resulting in a server-side request forgery (SSRF) vulnerability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Apicurio Registry issuing HTTP GET requests to arbitrary internal URLs when processing malicious WSDL files with the VALIDITY rule set to FULL. Detection can focus on monitoring unusual outbound HTTP requests from the registry server to internal or unexpected endpoints.

You can detect exploitation attempts by inspecting logs for HTTP requests initiated by the Apicurio Registry to internal services or cloud metadata endpoints that are not normally accessed.

Additionally, monitoring for uploads of WSDL files containing suspicious import locations by users with Developer-role access can help identify potential exploitation.

Specific commands are not provided in the resources, but general network monitoring tools like tcpdump or Wireshark can be used to capture outbound HTTP traffic from the registry server. For example:

• tcpdump -i <interface> -nn -s0 -A port 80 or port 443
• grep or analyze Apicurio Registry logs for HTTP requests to internal IP ranges or unusual domains.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Developer-role access can exploit this vulnerability to make the Apicurio Registry server send HTTP requests to internal URLs that the attacker controls.

This can lead to unauthorized access to internal systems, potential data leakage, or further attacks within the internal network.

The CVSS score of 7.4 indicates a high severity impact affecting confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker with Developer-role access to perform server-side request forgery (SSRF) by uploading malicious WSDL documents that cause the registry to make HTTP requests to arbitrary internal URLs. This can lead to unauthorized access or exposure of internal services and potentially sensitive data.

Such unauthorized internal requests and potential data exposure could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls over data access and protection of sensitive information.

However, the provided information does not explicitly discuss compliance impacts or specific regulatory consequences.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation is to disable the import dereference feature in the WSDLReader used by Apicurio Registry.

Specifically, the following features should be disabled in the WSDLReader configuration:

• wsdlReader.setFeature("javax.wsdl.importDocuments", false)
• wsdlReader.setFeature("com.ibm.wsdl.parseXMLSchemas", false)

Long-term recommendations include replacing the unmaintained wsdl4j library with a maintained alternative like Apache Woden or restricting WSDL validation to SYNTAX_ONLY level to prevent recursive fetching of imports.

Useful 0 Not Useful 0