CVE-2023-2140
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in DELMIA Apriso manufacturing software. Unauthenticated attackers can force the application server to make requests to arbitrary internal or external systems, potentially accessing sensitive data or internal services. Organizations using DELMIA Apriso Release 2017 through Release 2022 are affected.
💻 Affected Systems
- DELMIA Apriso
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal systems, exfiltrate sensitive data, pivot to other network segments, or abuse the server's trusted position to attack third-party systems.
Likely Case
Information disclosure from internal services, scanning of internal networks, or abuse of the server to attack other systems.
If Mitigated
Limited impact if network segmentation restricts server outbound access and internal services require authentication.
🎯 Exploit Status
SSRF vulnerabilities typically have low exploitation complexity once the vulnerable endpoint is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Dassault Systèmes advisory for specific patched versions
Vendor Advisory: https://www.3ds.com/vulnerability/advisories
Restart Required: Yes
Instructions:
1. Review Dassault Systèmes security advisory. 2. Apply the recommended patch/update. 3. Restart the DELMIA Apriso application services. 4. Verify the fix.
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from the DELMIA Apriso server to only necessary destinations
Web Application Firewall
allDeploy WAF rules to block SSRF patterns and unexpected outbound requests
🧯 If You Can't Patch
- Implement strict network egress filtering to limit the server's outbound connections
- Deploy the application behind a reverse proxy that validates and sanitizes all outgoing requests
🔍 How to Verify
Check if Vulnerable:
Check DELMIA Apriso version against affected range (2017-2022). If unpatched and within range, assume vulnerable.Check Version:
Check within DELMIA Apriso administration interface or installation documentationVerify Fix Applied:
Verify installed version is newer than affected versions and test SSRF functionality is blocked.📡 Detection & Monitoring
Log Indicators:
- Unexpected outbound HTTP requests from DELMIA Apriso server
- Requests to internal IP ranges or unusual domains
Network Indicators:
- DELMIA Apriso server making requests to unexpected destinations
- Pattern of requests to internal services from the application server
SIEM Query:
source_ip="DELMIA_SERVER_IP" AND (dest_ip IN [INTERNAL_RANGES] OR dest_domain NOT IN [ALLOWED_DOMAINS])