Miggo Logo
Miggo Vulnerability Database
→
GHSA-3xgr-h5hq-7299

GHSA-3xgr-h5hq-7299: GeoIP processor disables SSL certificate validation when downloading databases

5.9

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-3xgr-h5hq-7299
EPSS Score
-
CWE
CWE-295
Published
10/15/2025
Updated
10/15/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.opensearch.dataprepper.plugins:geoip-processormaven>= 2.7.0, < 2.12.22.12.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability is caused by a custom and insecure SSL implementation in the GeoIP processor of Data Prepper. The DBSource.initiateSSL() method was created to intentionally bypass SSL certificate and hostname verification during the download of GeoIP databases. This method was called by HttpDBDownloadService.initiateDownload(), which is responsible for fetching the database from a URL. This creates a Man-in-the-Middle (MITM) vulnerability, allowing an attacker to intercept the connection and provide a malicious GeoIP database. The patch addresses this by completely removing the initiateSSL() method and its call from HttpDBDownloadService.initiateDownload(), thereby ensuring that the standard and secure Java TLS implementation is used for all HTTPS connections. The primary vulnerable function is DBSource.initiateSSL() due to its insecure implementation, and HttpDBDownloadService.initiateDownload() is the function that triggers the vulnerability by calling it.

Vulnerable functions

org.opensearch.dataprepper.plugins.geoip.extension.databasedownload.DBSource.initiateSSL
data-prepper-plugins/geoip-processor/src/main/java/org/opensearch/dataprepper/plugins/geoip/extension/databasedownload/DBSource.java
This function implements a custom SSL context that explicitly disables certificate and hostname verification. It creates a `TrustManager` that accepts all server certificates and a `HostnameVerifier` that accepts all hostnames. This makes any HTTPS connection using this configuration vulnerable to Man-in-the-Middle (MITM) attacks.
org.opensearch.dataprepper.plugins.geoip.extension.databasedownload.HttpDBDownloadService.initiateDownload
data-prepper-plugins/geoip-processor/src/main/java/org/opensearch/dataprepper/plugins/geoip/extension/databasedownload/HttpDBDownloadService.java
This function calls the insecure `initiateSSL()` method before downloading the GeoIP database. By calling `initiateSSL()`, it makes the entire database download process vulnerable to MITM attacks, as SSL certificate validation is disabled. The patch removes this call.

WAF Protection Rules

WAF Rule

### Imp**t T** **oIP pro**ssor in **t* Pr*pp*r w*s *on*i*ur** to trust *ll SSL **rti*i**t*s *n* *is**l* *ostn*m* v*ri*i**tion w**n *ownlo**in* **oIP **t***s*s *rom *TTP URLs, m*kin* *ownlo**s vuln*r**l* to m*n-in-t**-mi**l* *tt**ks. T** **oIP pro**

Reasoning

T** vuln*r**ility is **us** *y * *ustom *n* ins**ur* SSL impl*m*nt*tion in t** **oIP pro**ssor o* **t* Pr*pp*r. T** `**Sour**.initi*t*SSL()` m*t*o* w*s *r**t** to int*ntion*lly *yp*ss SSL **rti*i**t* *n* *ostn*m* v*ri*i**tion *urin* t** *ownlo** o* *