Insufficient Session Isolation in Progress MarkLogic Server REST/XDBC Code Evaluation
AI analysis
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 fails to properly isolate user-supplied code executed via certain REST and XDBC evaluation paths from the surrounding HTTP request, response, and session state, an origin validation error (CWE-346). An attacker who can get code evaluated through an affected path — in this case with no privileges of their own but with some victim interaction, per the CVSS vector (PR:N/UI:R, scope changed) — could perform unauthorized actions or hijack an authenticated user's session. The result is high impact to confidentiality, integrity, and availability across the changed scope, earning a critical 9.6 rating. Affected deployments are any unpatched MarkLogic 11.x or 12.x servers exposing REST or XDBC evaluation endpoints to users, which is common in enterprise database and application-hosting configurations. No public proof of concept is known and the flaw is not on the CISA KEV list, so there is no evidence of active exploitation at this time.
What to do: Upgrade MarkLogic Server 12.x to 12.1.0 or later, or 11.x to 11.3.7 or later. Until patched, restrict access to REST and XDBC evaluation endpoints (ad-hoc eval/query paths) to trusted, authenticated users only, disable unneeded evaluation features, and avoid exposing MarkLogic App Servers to the public internet. Review server logs for unexpected evaluation requests or anomalous session activity originating from eval workloads.
Affected
| Progress MarkLogic Server | 12.x before 12.1.0 |
| Progress MarkLogic Server | 11.x before 11.3.7 |
Estimated exposure
nichelikely hundreds of internet-reachable instances out of a low-thousands global install base (estimate) — MarkLogic is an enterprise NoSQL database sold to a relatively small number of large organizations, and only a subset of those deployments typically expose REST/XDBC App Servers directly to the internet; no active-install counts or scan…
Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.