Cloudanix VulnDB

CVE-2019-17570

Critical · 9.8

CVSS

9.8

EPSS

49.3%

Published

Jan 23, 2020

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

An outdated XML library lets attackers take over computers that connect to a malicious server, and because the library is abandoned there is no official fix.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Remote Code Execution
Component
Library
Class
Deserialization
Remediation
No Fix Yet
Effort
Other
Patch risk
Other

What it actually does

Untrusted deserialization in XmlRpcResponseParser:addResult allows a malicious XML-RPC server to supply a crafted response that executes arbitrary code on the connecting client.

Why it matters to the business

Systems using the unmaintained Apache XML-RPC library risk full remote compromise when they act as clients; the flaw affects many Linux distributions and downstream packages with no vendor patches available, forcing migration or isolation.

How an attack unfolds

An attacker hosts a malicious XML-RPC server that returns a serialized payload containing a gadget chain; when a vulnerable client parses the response, the deserializer executes attacker-controlled code, granting a shell or further access.

How to fix it

Remove the Apache XML-RPC library entirely and migrate to a maintained alternative such as Apache XML-RPC 3.x successors or modern RPC frameworks; scan all codebases and package manifests for the ws-xmlrpc artifact and replace affected versions.

How to confirm the fix worked

Inventory Java/Maven/Gradle dependencies for org.apache.xmlrpc:xmlrpc or ws-xmlrpc JARs, confirm removal or replacement, and retest client connections against a controlled server to ensure no deserialization of untrusted data occurs.

Typical attack path

  1. Identify or compromise an XML-RPC endpoint that clients will contact
  2. Craft a malicious serialized object that triggers code execution on deserialization
  3. Serve the payload from the attacker-controlled server
  4. Wait for or lure a vulnerable client to connect and receive the response
  5. Obtain code execution on the client system

How to detect it

Search application and proxy logs for unexpected XML-RPC responses containing serialized Java objects, monitor for child processes spawned during XML-RPC client handling, and review network flows for clients contacting previously unknown servers.

What your security team should do

  • Immediately inventory all applications for the vulnerable library and prioritize removal
  • Block outbound XML-RPC traffic to untrusted servers via network controls until migration completes
  • Add dependency scanning rules to prevent reintroduction of the library
  • Monitor for any remaining usage in production environments

The record

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.apache.xmlrpc:xmlrpc 0 No fix
Debian:10 libxmlrpc3-java 0 3.1.3-9+deb10u1
Debian:8 libxmlrpc3-java 0 3.1.3-7+deb8u1
Debian:9 libxmlrpc3-java 0 3.1.3-8+deb9u1
Mageia:7 xmlrpc 0 3.1.3-73.1.mga7
Red Hat:rhel_software_collections:3::el6 rh-java-common-xmlrpc 0 1:3.1.3-8.17.el6
Red Hat:rhel_software_collections:3::el6 rh-java-common-xmlrpc-client 0 1:3.1.3-8.17.el6
Red Hat:rhel_software_collections:3::el6 rh-java-common-xmlrpc-common 0 1:3.1.3-8.17.el6
Red Hat:rhel_software_collections:3::el6 rh-java-common-xmlrpc-javadoc 0 1:3.1.3-8.17.el6
Red Hat:rhel_software_collections:3::el6 rh-java-common-xmlrpc-server 0 1:3.1.3-8.17.el6
Red Hat:rhel_software_collections:3::el7 rh-java-common-xmlrpc 0 1:3.1.3-8.17.el7
Red Hat:rhel_software_collections:3::el7 rh-java-common-xmlrpc-client 0 1:3.1.3-8.17.el7
Red Hat:rhel_software_collections:3::el7 rh-java-common-xmlrpc-common 0 1:3.1.3-8.17.el7
Red Hat:rhel_software_collections:3::el7 rh-java-common-xmlrpc-javadoc 0 1:3.1.3-8.17.el7
Red Hat:rhel_software_collections:3::el7 rh-java-common-xmlrpc-server 0 1:3.1.3-8.17.el7
Ubuntu:16.04:LTS libxmlrpc3-java 0 3.1.3-7+deb8u1build0.16.04.1
Ubuntu:18.04:LTS libxmlrpc3-java 0 3.1.3-9+deb10u1build0.18.04.1
maven org.apache.xmlrpc/xmlrpc 3.1 No fix

Related vulnerabilities