CVE-2023-40743: Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService
UNSUPPORTED WHEN ASSIGNED When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE.
As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.
Other sources
Apache Axis could allow a remote attacker to execute arbitrary code on the system, caused by improper input validation by the ServiceFactory.getService function. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code, cause a denial of service or perform SSRF attacks.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-40743?
CVE-2023-40743 is a vulnerability in Apache Axis 1.x that may allow remote code execution (RCE) when untrusted input is passed to the "getService" function.
What is the severity of CVE-2023-40743?
CVE-2023-40743 has a severity rating of critical with a CVSS score of 9.8.
How does CVE-2023-40743 affect Apache Axis 1.x?
CVE-2023-40743 affects Apache Axis 1.x by allowing potentially dangerous lookup mechanisms such as LDAP when using the "ServiceFactory.getService" function with untrusted input.
How can I fix CVE-2023-40743?
To fix CVE-2023-40743, it is recommended to upgrade to a supported version of Apache Axis or apply the necessary patches and security updates provided by the vendor.
Where can I find more information about CVE-2023-40743?
You can find more information about CVE-2023-40743 in the references provided: [Reference 1](https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210), [Reference 2](https://lists.apache.org/thread/gs0qgk2mgss7zfhzdd6ftfjvm4kp7v82), [Reference 3](https://lists.debian.org/debian-lts-announce/2023/10/msg00025.html).