2.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-12801

CVE-2024-12801: QOS.CH logback-core Server-Side Request Forgery vulnerability

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.

The attacks involves the modification of DOCTYPE declaration in XML configuration files.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-12801

CVE-2024-12801:

2.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ch.qos.logback:logback-core	maven	>= 1.4.0, < 1.5.13	1.5.13
ch.qos.logback:logback-core	maven	< 1.3.15	1.3.15

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an SSRF in SaxEventRecorder due to improper handling of XML DOCTYPE declarations. The provided patch (commit 5f05041cba4c4ac0a62748c5c527a2da48999f2d) addresses this by adding an override for the resolveEntity method within the SaxEventRecorder.java file. This new resolveEntity method explicitly disallows external DTDs by returning an empty input stream. The functions recordEvents(InputStream) and recordEvents(InputSource) in SaxEventRecorder are responsible for initiating the XML parsing process. They call saxParser.parse(inputSource, this), where this is the SaxEventRecorder instance acting as the SAX handler. Before the patch, this handler lacked the protective resolveEntity override, making these recordEvents methods the entry points for the SSRF vulnerability when processing malicious XML configuration files. The vulnerability description also directly names SaxEventRecorder as the affected component.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.