CVE-2023-3432
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in PlantUML versions prior to 1.2023.9. Attackers can exploit this vulnerability to make the PlantUML server send unauthorized requests to internal systems, potentially accessing sensitive data or services. Anyone using PlantUML server versions before 1.2023.9 is affected.
💻 Affected Systems
- PlantUML
📦 What is this software?
Fedora by Fedoraproject
Plantuml by Plantuml
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network resources, data exfiltration from internal services, or lateral movement to other systems via the PlantUML server's network position.
Likely Case
Unauthorized access to internal HTTP/HTTPS services, metadata services (like AWS/Azure instance metadata), or internal APIs that the PlantUML server can reach.
If Mitigated
Limited impact if network segmentation restricts PlantUML server's outbound connections and internal services require authentication.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited and public proof-of-concept exists in the commit references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2023.9 and later
Vendor Advisory: https://github.com/plantuml/plantuml/commit/b32500bb61ae617bb312496d6d832e4be8190797
Restart Required: Yes
Instructions:
1. Download PlantUML version 1.2023.9 or later from https://plantuml.com/download. 2. Replace existing PlantUML JAR/WAR files with the updated version. 3. Restart the PlantUML server/service.
🔧 Temporary Workarounds
Network Restriction
linuxRestrict outbound network connections from the PlantUML server using firewall rules
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
Input Validation
allImplement input validation to reject PlantUML definitions containing URLs or network references
🧯 If You Can't Patch
- Deploy network segmentation to isolate PlantUML server from sensitive internal systems
- Implement web application firewall (WAF) rules to detect and block SSRF patterns in requests
🔍 How to Verify
Check if Vulnerable:
Check PlantUML version: java -jar plantuml.jar -version | grep -i versionCheck Version:
java -jar plantuml.jar -versionVerify Fix Applied:
Verify version is 1.2023.9 or higher: java -jar plantuml.jar -version📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP/HTTPS requests from PlantUML server
- Requests to internal IP addresses or metadata services
Network Indicators:
- PlantUML server making unexpected connections to internal services
- HTTP requests to 169.254.169.254 (AWS metadata) or similar
SIEM Query:
source="plantuml.log" AND (dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16 OR dest_ip=169.254.169.254)🔗 References
- https://github.com/plantuml/plantuml/commit/b32500bb61ae617bb312496d6d832e4be8190797
- https://huntr.dev/bounties/8ac3316f-431c-468d-87e4-3dafff2ecf51
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FV7XL3CY3K3K5ER3ASMEQA546MIQQ7QM/
- https://github.com/plantuml/plantuml/commit/b32500bb61ae617bb312496d6d832e4be8190797
- https://huntr.dev/bounties/8ac3316f-431c-468d-87e4-3dafff2ecf51
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FV7XL3CY3K3K5ER3ASMEQA546MIQQ7QM/
