Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the security patch (commit 131e8576dcf3613f944c3e02527959bbf52370c3) reveals a classic Server-Side Request Forgery (SSRF) vulnerability in the DSMLv2 gateway. The root cause lies in the org.opends.dsml.protocol.ByteStringUtility.convertValue function. Before the patch, this function would receive a java.net.URI object and directly open a stream to it using toURL().openStream(). This was done without any validation of the URI's scheme or target address, and without any limits on the amount of data read.
This flaw allowed an unauthenticated attacker to craft a DSML request containing a malicious anyURI value. This could be a file: URI to read local files on the server, an http: URI pointing to internal services or cloud metadata endpoints (SSRF), or a URI to a massive resource that would exhaust server memory (DoS).
The DSMLServlet.init method was also identified as a key enabler of the vulnerability. It unconditionally set a system property (mapAnyUriToUri) that caused the DSML parser to convert incoming URI strings into the java.net.URI objects that convertValue would then process unsafely.
The patch remediates these issues by:
convertUri function, which checks the URI scheme against an allowlist, blocks requests to internal/private IP addresses, refuses to follow HTTP redirects, and enforces a size limit on the response.org.opends.dsml.protocol.ByteStringUtility.convertValueopendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/ByteStringUtility.java
org.opends.dsml.protocol.DSMLServlet.initopendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.openidentityplatform.opendj:opendj-dsml-servlet | maven | <= 5.1.1 | 5.1.2 |