GHSA-G9PH-J5VJ-F8WM

Vulnerability from github – Published: 2024-08-21 18:27 – Updated: 2024-08-21 18:27
VLAI
Summary
Potential access to sensitive URLs via CKAN extensions (SSRF)
Details

Impact

There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming contents or saving a local copy). All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it (known as a Server Side Request Forgery).

Patches and Workarounds

Users wanting to protect against these kinds of attacks can use one or a combination of the following approaches:

  • Use a separate HTTP proxy like Squid that can be used to allow / disallow IPs, domains etc as needed, and make CKAN extensions aware of this setting via the ckan.download_proxy config option.
  • Implement custom firewall rules to prevent access to restricted resources.
  • Use custom validators on the resource url field to block/allow certain domains or IPs.

All latest versions of the plugins linked above support the ckan.download_proxy settings. Support for this setting in the Resource Proxy plugin was included in CKAN 2.10.5 and 2.11.0

References

  • Blog post provides more details on how to configure a Squid proxy to prevent these issues
Severity
4.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
6.8 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ckan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-43371"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-21T18:27:11Z",
    "nvd_published_at": "2024-08-21T15:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThere are a number of CKAN plugins, including [XLoader](https://github.com/ckan/ckanext-xloader), [DataPusher](https://github.com/ckan/datapusher), [Resource proxy](https://docs.ckan.org/en/latest/maintaining/data-viewer.html#resource-proxy) and [ckanext-archiver](https://github.com/ckan/ckanext-archiver/), that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming contents or saving a local copy). All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it (known as a [Server Side Request Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)).\n\n### Patches and Workarounds\n\nUsers wanting to protect against these kinds of attacks can use one or a combination of the following approaches:\n\n* Use a separate HTTP proxy like [Squid](https://www.squid-cache.org/) that can be used to allow / disallow IPs, domains etc as needed, and make CKAN extensions aware of this setting via the [`ckan.download_proxy`](https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-download-proxy) config option. \n* Implement custom firewall rules to prevent access to restricted resources.\n* Use custom validators on the resource `url` field to block/allow certain domains or IPs.\n\nAll latest versions of the plugins linked above support the `ckan.download_proxy` settings. Support for this setting in the Resource Proxy plugin was included in CKAN 2.10.5 and 2.11.0\n\n### References\n\n* [Blog post](https://feeding.cloud.geek.nz/posts/restricting-outgoing-webapp-requests-using-squid-proxy/) provides more details on how to configure a Squid proxy to prevent these issues\n",
  "id": "GHSA-g9ph-j5vj-f8wm",
  "modified": "2024-08-21T18:27:12Z",
  "published": "2024-08-21T18:27:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ckan/ckan/security/advisories/GHSA-g9ph-j5vj-f8wm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43371"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ckan/ckan/commit/382beaec98cb331f2a030459ef043c50eaf5ad53"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ckan/ckan/commit/8601183cc2fc87277ea5b33ff75c3a5610812ab5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ckan/ckan"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Potential access to sensitive URLs via CKAN extensions (SSRF)"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.