Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

CVE-2023-40743

Summary

The Apache Axis 1.x framework is susceptible to an input validation vulnerability when utilizing the 'ServiceFactory.getService' method. This method can process untrusted data, allowing for potentially harmful lookup mechanisms, including LDAP. Insecure input handling may lead to Denial of Service (DoS), Server-Side Request Forgery (SSRF), or even Remote Code Execution (RCE) attacks. The software's end-of-life status emphasizes the need for migration to an upgraded SOAP engine like Apache Axis 2/Java. It is crucial for developers to audit their applications to ensure that no unsanitized or untrusted input is passed to the 'ServiceFactory.getService' method. Patch details and further guidance can be found at the GitHub repository.

References