AI analysis
Progress MarkLogic Server contains a server-side request forgery (SSRF, CWE-918) flaw in Linux-based 12.x releases before 12.1.0 and 11.x releases before 11.3.7. An authenticated attacker can trick the database server into making requests to internal or cloud-side endpoints that should not be reachable from outside, such as cloud instance metadata services. Successful exploitation can expose cloud credentials, enabling unauthorized access to the organization's cloud environment; the CVSS 3.1 base score is 8.5 (high), reflecting high confidentiality impact with scope change, though it requires an authenticated account. Organizations running affected MarkLogic releases on Linux — particularly cloud-hosted deployments — are at risk. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and there is no indication of in-the-wild exploitation.
What to do: Upgrade Linux MarkLogic Server to 12.1.0 or later, or 11.3.7 or later for the 11.x branch. For cloud-hosted deployments, enforce IMDSv2 (AWS) or the equivalent hardened metadata service settings and restrict egress from MarkLogic hosts to metadata and internal cloud endpoints so the SSRF cannot reach credential stores. Review server logs for unexpected outbound requests from the MarkLogic host and rotate any cloud credentials if suspicious activity is found.
Affected
| Progress MarkLogic Server (Linux) | 12.x before 12.1.0 |
| Progress MarkLogic Server (Linux) | 11.x before 11.3.7 |
Estimated exposure
nichelikely hundreds to low thousands of installations, with only a subset internet-exposed — MarkLogic is a niche enterprise NoSQL database deployed primarily inside corporate and government networks, and public internet scans historically show only a few hundred exposed MarkLogic instances, though many more run internally or in…
Description
Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials.