Quick Take
- What: Apache Axis2/Java through 2.0.1 disclosed service metadata on multiple routes even when exposeServiceMetadata was set to false
- Who is affected: Deployments running Apache Axis2/Java versions through 2.0.1 that rely on exposeServiceMetadata to hide service details
- Severity: Medium (CVSS 5.3)
- What to do: Upgrade to Apache Axis2/Java version 2.0.2
- Status: Patch available
In plain English
Apache Axis2 is a web services framework used by developers to build SOAP-based applications. It has a setting called exposeServiceMetadata that is supposed to hide technical details about a service from anonymous visitors. However, this setting only worked on some routes, while other routes still disclosed operation names and data schemas even when the setting was turned off. Version 2.0.2 fixes this so the setting now works consistently across all routes.
What you should do: If you are an ordinary user who does not run web services, you can ignore this.
What happened
The exposeServiceMetadata service parameter in Apache Axis2/Java was only enforced on the ?wsdl, ?wsdl2 and ?xsd query routes. For a service that had disabled this parameter, multiple other routes still disclosed metadata to anonymous callers:
- Packaged .wsdl and .xsd file routes
- Named-WSDL ?wsdl=NAME route of the standalone HTTP server
- OpenAPI, Swagger UI and MCP catalog endpoints
- The /services/ listing
- WS-MetadataExchange GetMetadata
- The ping module
This metadata included operation names and request and response schemas. The vulnerability affects Apache Axis2/Java through version 2.0.1.
According to the release notes, the gate is now implemented in AxisService.isMetadataExposed() in the kernel, making it accessible to modules that answer anonymous metadata requests. Previously, the check was a private method in each HTTP transport, so modules could not reach it and did not apply the restriction.
The fix also addresses a separate issue where the ?xsd= route could reach any packaged META-INF resource, including services.xml, which contains parameters naming keystores and password-callback classes. The shared stream helper now serves only schema and WSDL documents.
What you should do
Upgrade to Apache Axis2/Java version 2.0.2, which fixes the issue. The release notes state that a service with exposure disabled is now skipped rather than refused on all routes, making it indistinguishable from one that is not deployed.
The release notes also document that the ?wsdl, ?wsdl2, ?xsd and ?policy query routes still answer 403 for a hidden service where an undeployed one gets 404, which is an existence oracle. This is tracked for a follow-up fix.
What it means
This vulnerability allowed attackers to discover technical details about web services that administrators intended to keep private. While the CVSS score of 5.3 indicates medium severity, the exposure of operation names and schemas could aid reconnaissance for further attacks. Organizations that relied on exposeServiceMetadata to hide service details from anonymous callers were not protected on multiple routes until version 2.0.2.
