Horizon Alert
Summary of the vulnerability and why it matters
This advisory addresses a critical vulnerability in Progress MarkLogic Server that could allow unauthorized actions or session compromise if an attacker can execute code through specific evaluation paths. The issue lies in how user-supplied code is isolated from HTTP request, response, and session data.
- Code execution could lead to unauthorized actions.
- Matters if your systems use MarkLogic for code evaluation.
- Confirm relevance and exposure of affected systems.
Attack Path
How an attacker could exploit the issue
An attacker could reach an affected MarkLogic Server through its network interfaces, potentially without needing authentication. By sending specially crafted requests to the server's REST or XDBC evaluation paths, an attacker could execute code. This code execution could then interfere with the server's handling of HTTP requests, responses, or session data, allowing the attacker to take unauthorized actions or hijack an existing user's session.
- Network access is required.
- Unauthenticated code execution triggers vulnerability.
- Unauthorized actions or session compromise.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an attacker could compromise an authenticated session or perform unauthorized actions by leveraging insufficiently isolated user-supplied code in certain REST and XDBC evaluation paths. This could affect the integrity of HTTP requests, responses, and session state.
- Authenticated session state.
- Code execution in evaluation paths.
- Unauthorized actions or session compromise.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability affects Progress MarkLogic Server, impacting how user-supplied code interacts with HTTP state through REST and XDBC evaluation paths. Ownership likely falls to the platform or application teams managing MarkLogic deployments, with the immediate first step being an inventory of all MarkLogic instances to assess exposure, criticality, and identify accountable owners for remediation planning.
- Platform or application teams own remediation.
- Verify instance reachability and criticality.
- Plan remediation based on identified risk.
