The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through version 5.1.1 is vulnerable to unauthenticated SSRF, local file read, and unbounded-read DoS attacks. This occurs because the gateway dereferences attacker-controlled xsd:anyURI values server-side without a scheme allowlist, egress filtering, or size caps, and is accessible without authentication by default. An attacker can submit DSML add/modify requests with URIs that trigger SSRF against internal services and cloud metadata endpoints, read local files via file: URIs, or cause memory exhaustion by unbounded response reads. The issue is resolved in version 5.1.2 by disabling anyURI dereferencing by default, restricting allowed URI schemes to http/https, blocking loopback, link-local, private, and reserved IP targets, refusing HTTP redirects, capping bytes read, and enforcing container-managed authentication by default.

An unauthenticated remote attacker can exploit this vulnerability to perform server-side request forgery (SSRF), potentially accessing internal services and cloud metadata endpoints. They can also read local files on the server and cause denial of service by exhausting memory through unbounded reads. The confidentiality and availability of the affected system are impacted, with high confidentiality impact and high availability impact as per the CVSS vector.

A fixed version 5.1.2 of OpenDJ DSMLv2 SOAP gateway is available that disables anyURI dereferencing by default, enforces an http/https allowlist, blocks loopback and private IP addresses, refuses HTTP redirects, caps the bytes read, and requires container-managed authentication by default. Users should upgrade to version 5.1.2 or later to remediate this vulnerability. No additional mitigation is required if running the fixed version.