Org.openidentityplatform.opendj:opendj dsml servlet: OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
Affects org.openidentityplatform.opendj:opendj-dsml-servletSource GCVE Database
- Patch
- Available – fixed in 5.1.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Mavenorg.openidentityplatform.opendj:opendj-dsml-servlet | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fixed version 5.1.2 of OpenDJ DSMLv2 SOAP gateway is available that disables anyURI dereferencing by default, enforces an http/https allowlist, blocks loopback and private IP addresses, refuses HTTP redirects, caps the bytes read, and requires container-managed authentication by default. Users should upgrade to version 5.1.2 or later to remediate this vulnerability. No additional mitigation is required if running the fixed version.
Description
OpenDJ DSMLv2 SOAP gateway versions prior to 5.1.2 allow unauthenticated remote attackers to perform server-side request forgery (SSRF), local file reads, and unbounded memory consumption leading to denial of service (DoS). This is due to dereferencing attacker-supplied anyURI values without proper allowlisting, egress filtering, or size limits. The vulnerability is fixed in version 5.1.2 by disabling anyURI dereferencing by default, enforcing an http/https allowlist, blocking loopback and private addresses, refusing redirects, capping read sizes, and requiring authentication by default.
Impact
An unauthenticated remote attacker can exploit this vulnerability to perform server-side request forgery (SSRF), potentially accessing internal services and cloud metadata endpoints. They can also read local files on the server and cause denial of service by exhausting memory through unbounded reads. The confidentiality and availability of the affected system are impacted, with high confidentiality impact and high availability impact as per the CVSS vector.
Summary
The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through version 5.1.1 is vulnerable to unauthenticated SSRF, local file read, and unbounded-read DoS attacks. This occurs because the gateway dereferences attacker-controlled xsd:anyURI values server-side without a scheme allowlist, egress filtering, or size caps, and is accessible without authentication by default. An attacker can submit DSML add/modify requests with URIs that trigger SSRF against internal services and cloud metadata endpoints, read local files via file: URIs, or cause memory exhaustion by unbounded response reads. The issue is resolved in version 5.1.2 by disabling anyURI dereferencing by default, restricting allowed URI schemes to http/https, blocking loopback, link-local, private, and reserved IP targets, refusing HTTP redirects, capping bytes read, and enforcing container-managed authentication by default.
Weaknesses
References
- github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-68r5-9hpg-7qw9 (opens in a new tab)
- github.com/OpenIdentityPlatform/OpenDJ/commit/131e8576dcf3613f944c3e02527959bbf52370c3 (opens in a new tab)
- github.com/OpenIdentityPlatform/OpenDJ (opens in a new tab)
- github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.2 (opens in a new tab)