SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks
Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to
forge requests by compromising logback configuration files in XML.
The attacks involves the modification of DOCTYPE declaration in XML configuration files.
Update to logback version 1.5.13 or later. If you are using the 1.3.x
series, update to logback version 1.3.15 or later. Note that the 1.4.x
series remains vulnerable.
Configurations
The attacker needs to access and write to logback configuration files. Alternatively, the attacker needs to be able to force the use of a malicious logback configuration file at application start.
Workarounds
Update to logback version 1.5.13 or later. If you are using the 1.3.x
series, update to logback version 1.3.15 or later. Note that the 1.4.x
series remains vulnerable.