Critical OpenDJ DSML Gateway Flaw Patched

OpenIdentityPlatform has released a patch for a critical vulnerability in the OpenDJ DSMLv2 SOAP gateway, tracked as GHSA-68r5-9hpg-7qw9. The flaw, which carries a CVSS score of 9.4, allows unauthenticated remote attackers to exploit the gateway to perform server-side request forgery, read local files, and trigger denial-of-service conditions.

What's at Risk

The vulnerability affects the opendj-dsml-servlet component in OpenIdentityPlatform OpenDJ versions 5.1.1 and earlier. Organizations deploying this software in an internet-facing capacity are at the highest risk, as the gateway is reachable without authentication by default.

Because the flaw resides in the DSMLv2 SOAP interface, any system configured to process these requests is exposed to unauthorized interaction. If the service is deployed within a protected network, attackers could potentially use it as a pivot point to reach internal services or cloud metadata endpoints that would otherwise be inaccessible from the public internet.

How the Flaw Works

This vulnerability involves improper input validation where the application dereferences user-supplied URIs without adequate security controls. In general, flaws of this class allow an attacker to trick a server into making requests on their behalf. By providing a crafted URI, an attacker can often force the application to interact with internal network resources or read sensitive files from the local filesystem.

When an application fails to restrict the protocols allowed in URI inputs, or neglects to implement size caps on the data retrieved, it becomes susceptible to resource exhaustion. This is a common pattern in server-side request forgery (SSRF) and unbounded-read vulnerabilities, where the server's own processing power and memory are weaponized against it. Without an allowlist for schemes or destinations, the server effectively becomes a proxy for the attacker's activities.

How to Protect Your Systems

• Upgrade to OpenDJ version 5.1.2 or later immediately to resolve the vulnerability.
• Ensure that any usage of the DSMLv2 gateway is protected by container-managed authentication.
• If the DSMLv2 gateway is not required for business operations, disable the component entirely to reduce the attack surface.
• Implement strict network egress filtering to prevent the application server from initiating unauthorized connections to internal or sensitive cloud metadata endpoints.
• Review system logs for unusual requests directed at the DSMLv2 gateway that contain unexpected URI patterns or file-system-related indicators.

Given the critical severity of this vulnerability and the ease of exploitation, applying the available patch should be a high priority for security teams. Leaving affected systems unpatched exposes the underlying infrastructure to direct unauthenticated access and potential data exfiltration. Promptly updating to version 5.1.2 ensures that dereferencing is disabled by default and that any enabled functionality is restricted by an allowlist and strict byte caps.