CVE-2018-15531
📋 TL;DR
CVE-2018-15531 is an XML External Entity (XXE) vulnerability in JavaMelody's parseSoapMethodName function that allows attackers to read arbitrary files from the server filesystem or conduct server-side request forgery (SSRF) attacks. This affects all Java applications using JavaMelody monitoring library before version 1.74.0. The vulnerability is particularly dangerous because it can be exploited via SOAP requests to the monitoring endpoint.
💻 Affected Systems
- JavaMelody
📦 What is this software?
Javamelody by Javamelody Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through file disclosure of sensitive files (passwords, keys, configuration), SSRF attacks against internal services, or potential remote code execution via file upload in some configurations.
Likely Case
Unauthorized reading of sensitive server files, disclosure of application credentials, and potential access to internal network resources via SSRF.
If Mitigated
Limited impact if proper network segmentation, file system permissions, and input validation are in place, though XXE vulnerabilities remain serious.
🎯 Exploit Status
Public exploit details are available in security advisories. The vulnerability is straightforward to exploit with standard XXE payloads targeting the SOAP endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.74.0
Vendor Advisory: https://github.com/javamelody/javamelody/wiki/ReleaseNotes
Restart Required: Yes
Instructions:
1. Update JavaMelody dependency to version 1.74.0 or later in your project's build configuration (Maven, Gradle, etc.). 2. Rebuild and redeploy your application. 3. Restart the application server to ensure the new version is loaded.
🔧 Temporary Workarounds
Disable XML external entity processing
allConfigure XML parsers to disable external entity resolution
Set XML parser properties: FEATURE_SECURE_PROCESSING = true, DISALLOW_DOCTYPE_DECL = true, EXTERNAL_GENERAL_ENTITIES = false, EXTERNAL_PARAMETER_ENTITIES = false, LOAD_EXTERNAL_DTD = false
Restrict access to JavaMelody endpoint
linuxBlock external access to /monitoring endpoint using firewall or web server configuration
iptables -A INPUT -p tcp --dport [app-port] -m string --string "/monitoring" --algo bm -j DROP
Add web server rewrite rule to block /monitoring/* paths
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems from sensitive internal resources
- Deploy a web application firewall (WAF) with XXE protection rules to block malicious SOAP requests
🔍 How to Verify
Check if Vulnerable:
Check your project's dependency management file (pom.xml, build.gradle) for JavaMelody version. If version is below 1.74.0, you are vulnerable. Also check if /monitoring endpoint responds to SOAP requests with XXE payloads.Check Version:
Check Maven: mvn dependency:tree | grep javamelody. Check Gradle: gradle dependencies | grep javamelody. Or check application's classpath for javamelody jar version.Verify Fix Applied:
Verify JavaMelody version is 1.74.0 or higher in deployed application. Test the /monitoring endpoint with XXE payloads to confirm they are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual SOAP requests to /monitoring endpoint
- XML parsing errors containing external entity references
- File read attempts from unexpected paths in application logs
Network Indicators:
- HTTP requests to /monitoring with XML content containing SYSTEM or PUBLIC DTD declarations
- Outbound connections from application server to internal services following SSRF patterns
SIEM Query:
source="application.log" AND ("/monitoring" AND ("SYSTEM" OR "PUBLIC" OR "<!ENTITY")) OR (destination_port=80 OR destination_port=443) AND source_ip=[app-server] AND NOT destination_ip IN [allowed-external]🔗 References
- http://www.openwall.com/lists/oss-security/2018/09/25/3
- https://github.com/javamelody/javamelody/commit/ef111822562d0b9365bd3e671a75b65bd0613353
- https://github.com/javamelody/javamelody/wiki/ReleaseNotes
- https://jenkins.io/security/advisory/2018-09-25/
- http://www.openwall.com/lists/oss-security/2018/09/25/3
- https://github.com/javamelody/javamelody/commit/ef111822562d0b9365bd3e671a75b65bd0613353
- https://github.com/javamelody/javamelody/wiki/ReleaseNotes
- https://jenkins.io/security/advisory/2018-09-25/
