CVE-2021-22696: Server-Side Request Forgery (SSRF)

April 2, 2021 (updated November 7, 2023)

Instead of sending a JWT token as a request parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the request_uri parameter. CXF was not validating the request_uri parameter and was making a REST request to the parameter in the request to retrieve a token.

References

cxf.apache.org/security-advisories.data/CVE-2021-22696.txt.asc
nvd.nist.gov/vuln/detail/CVE-2021-22696

Code Behaviors & Features

Detect and mitigate CVE-2021-22696 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →