Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.6

Logback core can be tricked into making unwanted network calls

CVE-2024-12801 · published 1 year ago
Summary

The Logback core library used for logging in Java applications can be manipulated through its XML configuration files. By changing the document type declaration, an attacker could cause the system to send requests to arbitrary locations, potentially exposing internal resources. Update to the latest safe version of Logback and review configuration files to ensure they are protected from unauthorized changes.

What to do
  • Update qos ch.qos.logback:logback-core to version 1.5.13.
  • Update qos ch.qos.logback:logback-core to version 1.3.15.
  • Update root io.root.ch.qos.logback:logback-core to version 1.3.15-root.io.1.
  • Update qos ch.qos.logback:logback-core to version 1.3.15-aikido.1.
  • Update debian logback to version 1:1.6.3-1.
Affected software
Ecosystem VendorProductAffected versions
maven qos ch.qos.logback:logback-core >= 1.4.0, < 1.5.13
< 1.3.15
Fix: upgrade to 1.5.13
Root:Maven root io.root.ch.qos.logback:logback-core < 1.3.15-root.io.1
Fix: upgrade to 1.3.15-root.io.1
Root:Maven qos ch.qos.logback:logback-core < 1.3.15-aikido.1
Fix: upgrade to 1.3.15-aikido.1
Debian:12 debian logback All versions
Debian:14 debian logback < 1:1.6.3-1
Fix: upgrade to 1:1.6.3-1
Original advisory text
Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on the Java platform, allows an attacker to forge requests by compromising logba...
Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in  XML configuration files.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.6 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published19 Dec 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-6v67-2wr5-gvf4 · GHSA
CVE-2024-12801 · NVD
ROOT-APP-MAVEN-CVE-2024-12801 · OSV
DEBIAN-CVE-2024-12801 · OSV
Track software like this
Free during beta