CVE-2024-28752
CRITICAL NUCLEIApache CXF < 3.5.8 - Server-Side Request Forgery via Aegis DataBinding
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-28752. PoCs published by ReaJason. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2024-28752, an SSRF vulnerability in Apache CXF. The exploit demonstrates how an attacker can use the `xop:Include` tag in a SOAP request to read arbitrary files from the server.
Description
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.
Exploits (1)
This repository contains a proof-of-concept exploit for CVE-2024-28752, an SSRF vulnerability in Apache CXF. The exploit demonstrates how an attacker can use the `xop:Include` tag in a SOAP request to read arbitrary files from the server.
Nuclei Templates (1)
http.component:"Apache CXF"
body="Apache CXF"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N