CVE-2019-0227

Q: What is the severity of CVE-2019-0227?

CVE-2019-0227 has a CVSS score of 7.5 (HIGH). This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Apache Axis 1.4 that allows attackers to make arbitrary HTTP requests from the vulnerable server. Legacy users still running the 2006 release of Axis 1.4 are affected, potentially enabling internal network scanning or remote code execution through chained attacks.

7.5 HIGH

SSRF

📋 TL;DR

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Apache Axis 1.4 that allows attackers to make arbitrary HTTP requests from the vulnerable server. Legacy users still running the 2006 release of Axis 1.4 are affected, potentially enabling internal network scanning or remote code execution through chained attacks.

💻 Affected Systems

Products:

Apache Axis

Versions: Axis 1.4 (2006 release)

Operating Systems: All platforms running Java

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects the 2006 release of Axis 1.4. Users building from the ongoing Axis 1.x Subversion repository or using Axis2 are not vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution through chained exploitation with internal network access, potentially leading to complete system compromise and lateral movement within the network.

🟠

Likely Case

Internal network reconnaissance, credential theft from internal services, or data exfiltration through SSRF to internal endpoints.

🟢

If Mitigated

Limited to port scanning or denial of service against internal services if proper network segmentation and input validation are in place.

🌐 Internet-Facing: HIGH - Internet-facing Axis services can be directly exploited to attack internal networks.

🏢 Internal Only: MEDIUM - Internal services could be used for lateral movement within the network if exploited.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Public exploit code exists and has been weaponized. The vulnerability can be exploited without authentication in default configurations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Axis2 1.7.9 or later, or build from Axis 1.x Subversion repository

Vendor Advisory: https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E

Restart Required: Yes

Instructions:

1. Migrate to Axis2 1.7.9 or later. 2. Alternatively, build from the Axis 1.x Subversion repository source. 3. Restart all affected services after upgrade.

🔧 Temporary Workarounds

Network Segmentation

all

Restrict outbound network access from Axis servers to only required internal services

Input Validation

all

Implement strict URL validation and whitelisting for all user-supplied URLs in Axis applications

🧯 If You Can't Patch

Implement strict network egress filtering to prevent Axis servers from accessing internal services
Deploy web application firewall (WAF) rules to block SSRF patterns and malicious URL inputs

🔍 How to Verify

Check if Vulnerable:

Check if running Apache Axis 1.4 from the 2006 release. Review application logs for unusual outbound HTTP requests.

Check Version:

Check Axis JAR file metadata or application startup logs for version information

Verify Fix Applied:

Verify Axis2 version is 1.7.9 or later, or confirm build is from Axis 1.x Subversion repository after April 2019.

📡 Detection & Monitoring

Log Indicators:

Unusual outbound HTTP requests from Axis server to internal IPs
Requests to unusual ports or internal services

Network Indicators:

HTTP traffic from Axis servers to unexpected internal destinations
Port scanning patterns originating from Axis servers

SIEM Query:

source_ip=axis_server AND (dest_ip=internal_range OR dest_port!=80,443)

📊 Metadata

CVE ID: CVE-2019-0227

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-918

Published: May 1, 2019

Last Updated: May 8, 2025

🔗 References

https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/ Exploit,Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
https://www.oracle.com/security-alerts/cpuApr2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Patch,Third Party Advisory
https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/ Exploit,Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
https://www.oracle.com/security-alerts/cpuApr2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Agile Engineering Data Management by Oracle

Agile Product Lifecycle Management by Oracle

Application Testing Suite by Oracle

Application Testing Suite by Oracle

Axis by Apache

Big Data Discovery by Oracle

Communications Asap Cartridges by Oracle

Communications Asap Cartridges by Oracle

Communications Design Studio by Oracle

Communications Design Studio by Oracle

Communications Design Studio by Oracle

Communications Design Studio by Oracle

Communications Element Manager by Oracle

Communications Element Manager by Oracle

Communications Element Manager by Oracle

Communications Element Manager by Oracle

Communications Network Integrity by Oracle

Communications Network Integrity by Oracle

Communications Order And Service Management by Oracle

Communications Order And Service Management by Oracle

Communications Session Report Manager by Oracle

Communications Session Report Manager by Oracle

Communications Session Report Manager by Oracle

Communications Session Report Manager by Oracle

Communications Session Route Manager by Oracle

Communications Session Route Manager by Oracle

Communications Session Route Manager by Oracle

Communications Session Route Manager by Oracle

Endeca Information Discovery Studio by Oracle

Enterprise Manager Base Platform by Oracle

Enterprise Manager Base Platform by Oracle

Enterprise Manager For Fusion Middleware by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Compliance Regulatory Reporting by Oracle

Financial Services Funds Transfer Pricing by Oracle

Flexcube Core Banking by Oracle

Flexcube Core Banking by Oracle

Flexcube Core Banking by Oracle

Flexcube Core Banking by Oracle

Flexcube Private Banking by Oracle

Flexcube Private Banking by Oracle

Hospitality Guest Access by Oracle

Hospitality Guest Access by Oracle

Instantis Enterprisetrack by Oracle

Instantis Enterprisetrack by Oracle

Instantis Enterprisetrack by Oracle

Internet Directory by Oracle

Internet Directory by Oracle

Knowledge by Oracle

Peoplesoft Enterprise Human Capital Management Human Resources by Oracle

Peoplesoft Enterprise Human Capital Management Human Resources by Oracle

Peoplesoft Enterprise Human Capital Management Human Resources by Oracle

Peoplesoft Enterprise Peopletools by Oracle

Peoplesoft Enterprise Peopletools by Oracle

Peoplesoft Enterprise Peopletools by Oracle

Policy Automation Connector For Siebel by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Rapid Planning by Oracle

Rapid Planning by Oracle

Real Time Decision Server by Oracle

Retail Order Broker by Oracle

Retail Order Broker by Oracle

Retail Order Broker by Oracle

Retail Xstore Point Of Service by Oracle

Secure Global Desktop by Oracle

Secure Global Desktop by Oracle

Siebel Ui Framework by Oracle

Tuxedo by Oracle

Tuxedo by Oracle

Webcenter Portal by Oracle