CVE-2024-12801: QOS.CH Logback SSRF Vulnerability

CVE-2024-12801 Overview

CVE-2024-12801 is a Server-Side Request Forgery (SSRF) vulnerability in the SaxEventRecorder component of QOS.CH Logback, a popular logging framework for the Java platform. The vulnerability exists in Logback versions 0.1 through 1.3.14 and 1.4.0 through 1.5.12. An attacker capable of modifying Logback's XML configuration files can forge server-side requests by manipulating the DOCTYPE declaration within those files.

Critical Impact

Attackers with local access who can modify Logback configuration files may leverage this SSRF vulnerability to forge internal requests, potentially accessing internal services or exfiltrating sensitive data from within the network perimeter.

Affected Products

• QOS.CH Logback versions 0.1 to 1.3.14
• QOS.CH Logback versions 1.4.0 to 1.5.12
• Java applications utilizing vulnerable Logback versions for logging

Discovery Timeline

• 2024-12-19 - CVE-2024-12801 published to NVD
• 2025-01-03 - Last updated in NVD database

Technical Details for CVE-2024-12801

Vulnerability Analysis

This Server-Side Request Forgery vulnerability resides in Logback's SaxEventRecorder class, which is responsible for parsing XML configuration files. The vulnerability arises from improper handling of external entities when processing XML documents.

When Logback parses its configuration files, the SaxEventRecorder component does not adequately restrict the processing of external entity references within DOCTYPE declarations. This allows an attacker who has gained the ability to modify configuration files to inject malicious DOCTYPE declarations that cause the server to make arbitrary HTTP requests to internal or external endpoints.

The attack surface requires local access to the system or another vulnerability that permits modification of the Logback XML configuration files (typically logback.xml or logback-spring.xml). While this precondition limits exploitation scenarios, environments with misconfigured file permissions or applications that allow user-controlled configuration files may be at elevated risk.

Root Cause

The root cause of CVE-2024-12801 is the failure to disable external entity processing in the XML parser used by SaxEventRecorder. When parsing XML configuration files, the component allows DOCTYPE declarations containing external entity references, which can be leveraged to initiate server-side requests to arbitrary URLs.

Attack Vector

The attack requires local access to the target system. An attacker must be able to modify Logback's XML configuration files to inject a malicious DOCTYPE declaration. Upon the next parsing of the configuration file (such as during application startup or configuration reload), the embedded external entity reference triggers the SSRF condition.

The exploitation mechanism involves modifying the DOCTYPE declaration at the beginning of the XML configuration file to reference an external entity. When Logback processes this modified configuration, the XML parser attempts to resolve the external entity, resulting in an outbound HTTP request to the attacker-specified URL. This can be used to probe internal network services, access metadata endpoints in cloud environments, or exfiltrate data through out-of-band channels.

Detection Methods for CVE-2024-12801

Indicators of Compromise

• Unexpected modifications to Logback configuration files (logback.xml, logback-spring.xml, or custom configuration files)
• Presence of DOCTYPE declarations containing SYSTEM or PUBLIC identifiers in configuration files
• Unusual outbound network connections originating from Java application processes
• Log entries indicating XML parsing errors or external entity resolution attempts

Detection Strategies

• Implement file integrity monitoring (FIM) on Logback configuration files to detect unauthorized modifications
• Monitor network traffic from application servers for unexpected outbound HTTP/HTTPS requests to internal addresses or unusual external endpoints
• Deploy application-level logging to capture XML parsing events and configuration reloads
• Utilize static code analysis tools to identify applications using vulnerable Logback versions

Monitoring Recommendations

• Configure alerts for any changes to Logback XML configuration files in production environments
• Establish baseline network behavior for Java applications and alert on deviations, particularly requests to internal infrastructure or cloud metadata services
• Implement centralized logging to correlate configuration file changes with subsequent network activity

How to Mitigate CVE-2024-12801

Immediate Actions Required

• Upgrade Logback to version 1.3.15 or later for the 1.3.x branch
• Upgrade Logback to version 1.5.13 or later for the 1.5.x branch
• Review and restrict file system permissions on Logback configuration files to prevent unauthorized modifications
• Audit existing configuration files for suspicious DOCTYPE declarations

Patch Information

QOS.CH has released patched versions of Logback that address this SSRF vulnerability. Organizations should upgrade to the following versions:

• Logback 1.3.x users: Upgrade to version 1.3.15 or later. See Logback Release Notes 1.3.15 for details.
• Logback 1.5.x users: Upgrade to version 1.5.13 or later. See Logback Release Notes 1.5.13 for details.

Workarounds

• Ensure Logback configuration files are read-only and owned by a privileged user account that application processes cannot modify
• Implement network segmentation to limit the impact of potential SSRF attacks by restricting outbound connectivity from application servers
• Deploy web application firewalls (WAF) or network-based controls to block unauthorized outbound requests from application tiers
• Consider using Logback's programmatic configuration approach instead of XML-based configuration to eliminate the XML parsing attack surface

# Restrict permissions on Logback configuration files
chmod 644 /path/to/logback.xml
chown root:root /path/to/logback.xml

# Verify Logback version in Maven projects
mvn dependency:tree | grep logback

# Update Logback in pom.xml to patched version (1.5.x branch example)
# <dependency>
#     <groupId>ch.qos.logback</groupId>
#     <artifactId>logback-classic</artifactId>
#     <version>1.5.13</version>
# </dependency>