Executive brief
Spring Web Services, a framework for building SOAP-based web services, fails to validate destination addresses supplied in WS-Addressing headers. An unauthenticated attacker can inject malicious reply-to or fault-to addresses in requests, causing the server to initiate outbound connections to arbitrary internal or external systems. This enables reconnaissance of internal networks, data exfiltration, or attacks on systems that the vulnerable server can reach.
Technical details
This is a Server-Side Request Forgery (SSRF) vulnerability in the WS-Addressing support of Spring Web Services. The root cause is insufficient validation of ReplyTo and FaultTo URI addresses parsed from incoming SOAP requests. When WS-Addressing is enabled with non-anonymous reply destinations, Spring WS directly uses request-supplied URIs to initiate outbound connections via configured WebServiceMessageSender instances without verifying that those destinations are safe to connect to. The attack requires network access to the vulnerable service but no prior authentication or user interaction. An attacker can craft SOAP requests with malicious WS-Addressing headers to trigger connections to internal IP ranges, private networks, or sensitive services. Patches have been released in versions 5.0.2 and 4.1.4; earlier versions (4.0.0-4.0.18 and 3.1.0-3.1.8) have no documented patches. The fix introduces a DestinationPolicy validation framework with transport-specific checks and stricter defaults (e.g., blocking RFC 1918 private addresses and disabling DNS resolution in HTTP senders by default).
Affected products
- Spring Spring Web Services 5.0.0 through 5.0.1, 4.1.0 through 4.1.3, 4.0.0 through 4.0.18, 3.1.0 through 3.1.8
Timeline
- 2026-06-11: disclosed: Published to GitHub Advisory Database and NVD
- 2026-06-09: patched: Fix commit 5121a4e released; patched versions 5.0.2 and 4.1.4 available