{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/opendj--5.1.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenDJ \u003c= 5.1.1"],"_cs_severities":["critical"],"_cs_tags":["ssrf","file-read","denial-of-service","web-application","unauthenticated"],"_cs_type":"advisory","_cs_vendors":["OpenIdentityPlatform"],"content_html":"\u003cp\u003eA critical vulnerability exists in the DSMLv2 SOAP gateway, specifically the \u003ccode\u003eopendj-dsml-servlet\u003c/code\u003e component, within OpenIdentityPlatform OpenDJ versions through 5.1.1. This flaw allows a remote, unauthenticated attacker to perform server-side request forgery (SSRF) against internal services and cloud metadata endpoints, read arbitrary local files using \u003ccode\u003efile:\u003c/code\u003e URIs, and trigger a denial-of-service (DoS) condition. The vulnerability stems from the server's improper handling of attacker-supplied \u003ccode\u003exsd:anyURI\u003c/code\u003e values, which are dereferenced without sufficient scheme allowlisting, egress filtering, or size limitations. The \u003ccode\u003eopendj-dsml-servlet\u003c/code\u003e is exposed without authentication by default, making exploitation straightforward. This vulnerability poses a significant risk of data exfiltration, internal network reconnaissance, and service disruption for affected organizations running vulnerable OpenDJ instances. The issue was addressed in OpenDJ version 5.1.2, which disables \u003ccode\u003eanyURI\u003c/code\u003e dereferencing by default and enforces strict validation and authentication when enabled.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies an internet-accessible OpenDJ instance running version 5.1.1 or older with the \u003ccode\u003eopendj-dsml-servlet\u003c/code\u003e component exposed.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious DSML add/modify request containing a specially designed \u003ccode\u003exsd:anyURI\u003c/code\u003e value embedded within the request body.\u003c/li\u003e\n\u003cli\u003eTo achieve local file access, the attacker specifies a \u003ccode\u003efile:///\u003c/code\u003e URI, such as \u003ccode\u003efile:///etc/passwd\u003c/code\u003e. For SSRF, an internal network URI like \u003ccode\u003ehttp://169.254.169.254/latest/meta-data/\u003c/code\u003e or an internal IP address is used. For a DoS attack, a URI pointing to a large, unbounded resource is chosen.\u003c/li\u003e\n\u003cli\u003eThe crafted DSML request is then sent via an HTTP POST request to the vulnerable \u003ccode\u003eopendj-dsml-servlet\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe OpenDJ DSMLv2 gateway, lacking proper validation and egress filtering, attempts to dereference the attacker-supplied \u003ccode\u003exsd:anyURI\u003c/code\u003e value on the server side.\u003c/li\u003e\n\u003cli\u003eUpon successful exploitation:\u003c/li\u003e\n\u003c/ol\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eSSRF\u003c/strong\u003e: The server makes a request to the specified internal service or cloud metadata endpoint, potentially exposing sensitive information or enabling interaction with internal network resources.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLocal File Read\u003c/strong\u003e: The server reads the content of the local file specified by the \u003ccode\u003efile:\u003c/code\u003e URI and includes it within its response, exfiltrating the data to the attacker.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDoS\u003c/strong\u003e: The server attempts to read an unbounded response from the dereferenced URI, consuming excessive memory and leading to a denial-of-service condition for the OpenDJ instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability by a remote, unauthenticated attacker can lead to significant consequences for affected organizations. Attackers can read sensitive local files, such as configuration files, password hashes, or other proprietary data, potentially leading to further compromise or data exfiltration. The ability to perform Server-Side Request Forgery (SSRF) allows attackers to interact with internal services that are otherwise not directly exposed to the internet, including cloud metadata endpoints, facilitating network reconnaissance, privilege escalation, or access to sensitive cloud resources. Furthermore, the unbounded response read vulnerability can cause memory exhaustion, leading to a denial-of-service condition that disrupts the availability of the OpenDJ service and potentially other dependent applications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenDJ to version 5.1.2 or newer immediately to apply the security patches.\u003c/li\u003e\n\u003cli\u003eConfigure the \u003ccode\u003eopendj-dsml-servlet\u003c/code\u003e to require container-managed authentication by default, as introduced in version 5.1.2.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not feasible, ensure that \u003ccode\u003eanyURI\u003c/code\u003e dereferencing is disabled. If \u003ccode\u003eanyURI\u003c/code\u003e dereferencing must be enabled, configure it to strictly limit to http/https allowlist, reject loopback, link-local, private, and reserved targets, refuse HTTP redirects, and cap the bytes read.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:48:21Z","date_published":"2026-07-24T21:48:21Z","id":"https://feed.craftedsignal.io/briefs/2026-07-opendisml-vulnerability/","summary":"A remote, unauthenticated attacker can exploit a critical vulnerability in the DSMLv2 SOAP gateway (opendj-dsml-servlet) of OpenIdentityPlatform OpenDJ versions up to 5.1.1, allowing server-side request forgery (SSRF), local file reading via `file:` URIs, and denial-of-service (DoS) due to unbounded response reads by submitting specially crafted DSML add/modify requests.","title":"OpenDJ DSMLv2 Gateway Vulnerability Allows Unauthenticated SSRF, Local File Read, and DoS","url":"https://feed.craftedsignal.io/briefs/2026-07-opendisml-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenDJ \u003c= 5.1.1","version":"https://jsonfeed.org/version/1.1"}