CVE-2024-28752

The vulnerability is present only in configurations using Aegis DataBinding — the default databinding mechanism is not vulnerable. An attacker can prepare appropriately malicious input data and pass it to any web service built on Apache CXF with Aegis DataBinding, provided it accepts at least one parameter of any type. The server processes this data and may be induced to execute HTTP requests to internal or external resources that the attacker would not normally have access to.

An attacker can gain unauthorized access to internal network resources (SSRF), read sensitive information, and affect the integrity of operations performed by the server on behalf of the attacker. This can lead to exposure of internal infrastructure and escalation to further attacks on the internal network.

Apache CXF should be updated to version 4.0.4, 3.6.3, or 3.5.8 (depending on the branch used). If an update is not immediately possible, consider switching to the default databinding mechanism instead of Aegis DataBinding. NetApp product users should apply patches according to the manufacturer's recommendations available at security.netapp.com.

Apache CXF in versions before 4.0.4, before 3.6.3, and before 3.5.8, only when Aegis DataBinding is used. It also affects NetApp products: OnCommand Workflow Automation and ONTAP Tools (versions specified in NetApp manufacturer references).