AI analysis
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7, when deployed on Azure, contain a server-side request forgery (SSRF) flaw (CWE-918). An authenticated attacker with low-privileged access tricks the server into making requests to internal cloud services that should not be reachable from outside, such as Azure's instance metadata endpoints. Successful abuse can expose cloud credentials, tokens, or other sensitive internal data, enabling further movement within the cloud environment (CVSS 3.1: 8.8-equivalent severity rated 8.5, high, with low privileges required and changed scope). Only Azure-hosted deployments of the affected versions are exposed; on-premises and other cloud deployments are not covered by this advisory. There is no known public proof of concept, and the flaw is not on the CISA Known Exploited Vulnerabilities list as of this writing.
What to do: Upgrade Azure deployments of MarkLogic Server 12.x to 12.1.0 or later, or 11.x to 11.3.7 or later. Until patched, restrict outbound traffic from MarkLogic hosts to internal/cloud-link-local endpoints (notably the Azure Instance Metadata Service) and audit logs for unexpected requests to internal addresses. If exploitation is suspected, rotate managed identity credentials, storage keys, and any tokens accessible from the instance.
Affected
| Progress MarkLogic Server | 12.x before 12.1.0 (Azure deployments) |
| Progress MarkLogic Server | 11.x before 11.3.7 (Azure deployments) |
Estimated exposure
nichelikely hundreds to low thousands of Azure-hosted MarkLogic instances (enterprise customer base) — MarkLogic is a commercial enterprise NoSQL database with a customer base measured in the low thousands of organizations, only a subset of which run it on Azure, and there is no public active-install or scan-based count to draw on.
Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.