Skip to content

Server Side Request forgery

Critical
giohappy published GHSA-rmxg-6qqf-x8mr Aug 23, 2023

Package

No package listed

Affected versions

> 3.2.0

Patched versions

None

Description

Summary

Hello, I have found a server side request forgery vuln within geonode when testing on a bug bounty program. Server side request forgery allows a user to request information on the internal service/services.

Details

The endpoint /proxy/?url= does not properly protect against SSRF. when using the following format you can request internal hosts and display data. /proxy/?url=http://169.254.169.254\@whitelistedIPhere. This will state wether the AWS internal IP is alive. If you get a 404, the host is alive. A non alive host will not display a response. To display metadata, use a hashfrag on the url /proxy/?url=http://169.254.169.254\@#whitelisteddomain.com or try /proxy/?url=http://169.254.169.254\@%23whitelisteddomain.com

Impact

Port scan internal hosts, and request information from internal hosts.

Severity

Critical

CVE ID

CVE-2023-40017

Weaknesses

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Learn more on MITRE.

Credits