CVE-2024-34580

What it actually does

The library processes XML signatures without protection against SSRF payloads in KeyInfo elements, allowing crafted XML to trigger unauthorized network requests when processed.

Why it matters to the business

Direct use of this library exposes organizations to risks of unintended internal network access or information leakage unless extensive custom safeguards are added, with maintainers explicitly advising against continued direct use.

How an attack unfolds

An attacker with local access supplies a malicious XML document containing an SSRF payload in the KeyInfo element; when the library validates or processes the signature without additional protections, it issues network requests to attacker-controlled or internal targets.

How to fix it

Avoid direct use of Apache XML Security for C++ entirely; if unavoidable, implement additional secure configuration, input validation, and network controls as recommended by the project maintainers.

How to confirm the fix worked

Audit all code paths that invoke the library directly, review XML processing logic for KeyInfo handling, and test with crafted SSRF payloads while monitoring outbound connections.

Typical attack path

1. Gain local access or influence over an application using the library
2. Craft XML signature containing SSRF payload in KeyInfo element
3. Trigger processing of the malicious XML
4. Leverage resulting network requests for reconnaissance or further attacks

How to detect it

Review application logs for unexpected XML signature processing events and monitor process behavior for outbound network connections triggered during XML handling.

What your security team should do

• Inventory all direct dependencies on this library
• Plan migration to alternative, actively maintained XML security implementations
• Apply network egress controls and input sanitization around any remaining usage