CVE-2019-0227

HIGH

Apache Axis 1.4 - Server-Side Request Forgery

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2019-0227. PoCs published by David Yesland, ianxtianxt, 1475210817.

AI-analyzed exploit summary This exploit leverages CVE-2019-0227 to achieve remote code execution on Apache Axis 1.4 by deploying a malicious JSP payload via SSRF and MITM techniques. It uses ARP spoofing and iptables redirection to intercept and manipulate traffic.

Description

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

Exploits (3)

exploitdb WORKING POC
by David Yesland · pythonremotemultiple
https://www.exploit-db.com/exploits/46682

This exploit leverages CVE-2019-0227 to achieve remote code execution on Apache Axis 1.4 by deploying a malicious JSP payload via SSRF and MITM techniques. It uses ARP spoofing and iptables redirection to intercept and manipulate traffic.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Apache Axis < 1.4
No auth needed
Prerequisites: Network access to the target · Ability to perform ARP spoofing · Default Axis configuration
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 4 stars
by ianxtianxt · poc
https://github.com/ianxtianxt/cve-2019-0227

This is a functional exploit for CVE-2019-0227, targeting Apache Axis 1.4. It leverages a man-in-the-middle (MITM) attack via ARP spoofing and SSRF to deploy a malicious JSP payload, achieving remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Apache Axis < 1.4
No auth needed
Prerequisites: Network access to the target · ARP spoofing capability · Ability to intercept traffic · JSP payload file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by 1475210817 · poc
https://github.com/1475210817/Axis1.4-CVE-2019-0227

This repository contains functional exploit code for CVE-2019-0227, targeting Apache Axis 1.4 with two distinct methods: JSP webshell deployment and Freemarker-based direct command execution. The scripts demonstrate remote command execution by leveraging the AdminService interface when enableRemoteAdmin is enabled.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Axis 1.4
Auth required
Prerequisites: enableRemoteAdmin set to true · freemarker.jar present in WEB-INF/lib/ for Freemarker method
devstral-2 · analyzed May 19, 2026 Full analysis →

Scores

CVSS v3 7.5
EPSS 0.9012
EPSS Percentile 99.6%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-918
Status published
Products (50)
apache/axis 1.4
axis/axis 0Maven
oracle/agile_engineering_data_management 6.2.1.0
oracle/agile_product_lifecycle_management 9.3.3
oracle/application_testing_suite 13.2.0.1
oracle/application_testing_suite 13.3.0.1
oracle/big_data_discovery 1.6
oracle/communications_asap_cartridges 7.2
oracle/communications_asap_cartridges 7.3
oracle/communications_design_studio 7.3.4.3.0
... and 40 more
Published May 01, 2019
Tracked Since Feb 18, 2026