Apache XML Graphics Batik Flaw Exposes Sensitive Information

Two Server-Side Request Forgery (SSRF) vulnerabilities were found in Apache Batik, which could allow a threat actor to access sensitive information in Apache Batik.

These vulnerabilities exist in the Apache XML Graphics Batik and are given CVE IDs CVE-2022-44729 and CVE-2022-44730.

It is a Java-based application toolkit that is used for rendering, generating, and manipulating of SVG (Scalable Vector Graphics) format.

This tool contains multiple modules like SVG Parser, SVG Generator, and SVG DOM.

CVE-2022-44729 & CVE-2022-44730 Apache Batik Flaw

CVE-2022-44729, One of the SSRF vulnerabilities exists as Apache can be triggered to load external resources by using a malicious SVG, which could result in more resource consumption or information disclosure.

CVE-2022-44730, this vulnerability can be exploited by a threat actor by using a malicious SVG to probe user profile/data and send it directly as an URL parameter resulting in information disclosure.

In response to these vulnerabilities, Apache has patched these vulnerabilities by blocking external resources by default and creating a whitelist in the Rhino JS engine.

Batik prior to version 1.16, is affected by these vulnerabilities. Revisions have been made to the source code of Batik to fix these vulnerabilities. 

Users of Apache Batik are recommended to upgrade to the latest version 1.17, to prevent this vulnerability from getting exploited. 

Keep yourself informed about the latest Cyber Security News by following us on GoogleNewsLinkedinTwitter, and Facebook.

Eswar

Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense for initial access. Qlik Sense is…

15 hours ago

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer malware, and its new variant was being marketed in…

17 hours ago

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was carried out, specifically targeting hotels and…

18 hours ago

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical vulnerability that threat actors could potentially…

19 hours ago

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious links within seemingly legitimate payment requests. …

2 days ago

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed that the North Korean hacker group…

2 days ago