CVE-2024-28752

published 2024-03-15

CVE-2024-28752: A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on…

Priority P2 61 critical 9.3 CVSS 3.1

AV N AC L PR N UI R S C C H I H A N

EXPLOIT

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
apache	cxf	< 3.5.8	3.5.8
apache	cxf	>= 3.6.0 < 3.6.3	3.6.3
apache	cxf	>= 4.0.0 < 4.0.4	4.0.4
apache_software_foundation	apache_cxf	< 4.0.4, 3.6.3, 3.5.8	4.0.4, 3.6.3, 3.5.8
netapp	ontap_tools	—	—

Detection & IOCs extracted from sources · hover to see the quote

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache CXF Aegis DataBinding Server-Side Request Forgery (CVE-2024-28752)"; flow:established,to_server; http.method; content:"POST"; http.header_names; to_lowercase; content:"soapaction|0d 0a|"; http.request_body; content:"|3c|xop|3a|Include|20|href|3d 22|"; fast_pattern; pcre:"/^[a-z]+\x3a\x2f{2}/R"; reference:url,blog.csdn.net/Pumpk1n_/article/details/146193907; reference:cve,2024-28752; classtype:web-application-attack; sid:2062620; rev:1; metadata:attack_target Server, created_at 2025_05_29, cve CVE_2024_28752, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2025_05_29, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

bytes

|3c|xop|3a|Include|20|href|3d 22|

bytes

soapaction|0d 0a|

• → Exploit traffic is an HTTP POST request containing a SOAPAction header and an XOP Include element in the request body with an href attribute pointing to an attacker-controlled URI (SSRF payload). Match on POST method + soapaction header + <xop:Include href="..." body content.
• → Nuclei matcher: a successful probe response will contain the string 'Unmarshalling Error' in the body, the regex pattern 'cm9vd[A-Za-z0-9+/=]+' in the body, and Content-Type of 'text/xml'.
• → Vulnerability is only exploitable when Apache CXF is configured to use the Aegis DataBinding. Services using the default databinding are NOT affected. Triage should confirm Aegis databinding is in use before escalating. ↗

• · Only Apache CXF deployments explicitly configured to use the Aegis DataBinding are vulnerable. The default databinding is not affected, so detections should be scoped to services known to use Aegis to reduce false positives. ↗
• · Red Hat rates this as Important (not Critical) specifically because Aegis databinding is not the default configuration for Apache CXF, limiting the exposed population. ↗

CVSS provenance

nvd v3.1 9.3 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vendor_oracle 9.3 CRITICAL

vendor_redhat 9.3 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918