Eclipse Ditto
Monthly
Template injection in Eclipse Ditto's ImplicitThingCreationMessageMapper (versions 1.3.0 through 3.9.6) allows authenticated connection publishers to override the administrator-configured access policy of a newly provisioned digital twin by embedding JSON-breaking characters in attacker-controlled inbound message headers. The mapper substitutes header placeholder values as raw, unescaped strings into a pre-configured JSON thing-template before parsing, enabling a crafted header value containing a double-quote to escape its string context and inject an inline _policy object - effectively granting the attacker full read/write access to the twin while permanently revoking the legitimate owner's access. Exploitation requires a non-default mapper configuration and a template that reflects attacker-controllable headers; no public exploit code or active exploitation (CISA KEV) has been identified.
Server-side request forgery in Eclipse Ditto's Things service allows authenticated users with WRITE permission on a Thing to force the service to issue arbitrary HTTP GET requests to any host reachable from within the deployment's internal network. The vulnerability arises because the Things service fetches WoT ThingModel documents from attacker-supplied URLs in the Thing or Feature `definition` field without validating the target host, without re-validating redirect targets, and without enforcing a redirect hop limit. Attackers can leverage cloud instance-metadata endpoints (e.g., AWS IMDS at 169.254.169.254) and exploit differing HTTP error responses to enumerate internal services. No public exploit or CISA KEV entry exists at time of analysis.
Template injection in Eclipse Ditto's ImplicitThingCreationMessageMapper (versions 1.3.0 through 3.9.6) allows authenticated connection publishers to override the administrator-configured access policy of a newly provisioned digital twin by embedding JSON-breaking characters in attacker-controlled inbound message headers. The mapper substitutes header placeholder values as raw, unescaped strings into a pre-configured JSON thing-template before parsing, enabling a crafted header value containing a double-quote to escape its string context and inject an inline _policy object - effectively granting the attacker full read/write access to the twin while permanently revoking the legitimate owner's access. Exploitation requires a non-default mapper configuration and a template that reflects attacker-controllable headers; no public exploit code or active exploitation (CISA KEV) has been identified.
Server-side request forgery in Eclipse Ditto's Things service allows authenticated users with WRITE permission on a Thing to force the service to issue arbitrary HTTP GET requests to any host reachable from within the deployment's internal network. The vulnerability arises because the Things service fetches WoT ThingModel documents from attacker-supplied URLs in the Thing or Feature `definition` field without validating the target host, without re-validating redirect targets, and without enforcing a redirect hop limit. Attackers can leverage cloud instance-metadata endpoints (e.g., AWS IMDS at 169.254.169.254) and exploit differing HTTP error responses to enumerate internal services. No public exploit or CISA KEV entry exists at time of analysis.