dbcve.org
Server-Side Request Forgery (SSRF)Weakness · CWE-918

CVE-2024-34580

MEDIUM · 5.3 CVSS v3.1 Published 2024-06-26
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
55/100
Remediation priority · Elevated
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload in a KeyInfo element. NOTE: the project disputes this CVE Record on the grounds that any vulnerabilities are the result of a failure to configure XML Security for C++ securely. Even when avoiding this particular issue, any use of this library would need considerable additional code and a deep understanding of the standards and protocols involved to arrive at a secure implementation for any particular use case. We recommend against continued direct use of this library.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

Apache XML Security for C++ through 2.0.4 lacks protection against SSRF attacks when processing KeyInfo elements in XML signatures. The library will resolve/retrieve external URIs referenced in KeyInfo without validating whether those requests should be allowed, potentially allowing attackers to trigger requests to internal services.

MitigationAdd explicit URL allowlist validation or disable automatic resolution of external KeyInfo references; alternatively, migrate away from this library as recommended by the maintainers.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify if Apache XML Security for C++ is in use
    Search for library files such as libxml-security-c, libxmlsec1, or check application dependency manifests (package.json, pom.xml, requirements.txt, CMakeLists.txt) for xml-security-c or xml-security-cpp references
    Affected if The library is present in the environment or listed as a dependency
  2. Determine the installed version of the library
    Run version check command based on installation method: dpkg -l libxml-security-c, rpm -qi xml-security-c, or check the library file version string in the binary if statically linked
    Affected if The version is 2.0.4 or any earlier version (the vulnerability affects through 2.0.4)
  3. Identify if XML signature validation is performed
    Review application code or configuration for XML digital signature processing - search for calls to SignedXML, XMLSignature, or similar API methods that verify XML signatures
    Affected if The application processes or validates XML digital signatures
  4. Check if KeyInfo elements with external URIs are processed
    Audit XML documents being signed or validated for KeyInfo elements containing URI attributes (such as <KeyInfo><X509Data><X509Certificate> with external references, or custom KeyInfo with http/https URIs)
    Affected if The application processes XML signatures containing KeyInfo elements that reference external URIs

A user is affected if they use Apache XML Security for C++ version 2.0.4 or earlier and their application processes XML signatures containing KeyInfo elements with external URI references.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Add explicit URL allowlist validation or disable automatic resolution of external KeyInfo references; alternatively, migrate away from this library as recommended by the maintainers.

Recommended fix Moderate confidence
  1. This CVE is disputed by the vendor (Apache XML Security for C++ project) on the grounds that any vulnerability is due to insecure configuration, not a code defect.
  2. The vendor explicitly recommends against continued direct use of this library for any purpose.
  3. Consider migrating to an alternative XML signature library that provides safer defaults and clearer security documentation.
  4. If continued use is unavoidable, implement strict network segmentation and input validation around any code that processes XML with KeyInfo elements.
  5. Consult the XMLDsig specification and implement custom allow-listing for any URIs or external references that the library may resolve.
  6. Audit all XML signature processing code for SSRF vectors and implement defense-in-depth controls.
Caveat The vendor recommends against using this library at all; migration to an alternative is advised rather than an upgrade

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing8.0 h
  • Review / QA4.0 h
30.0 hours of engineering $5,280
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,448.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-34580 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-34580 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data