PT-2018-8319 · Sandstorm · Sandstorm

Shaolin · Publicado 2018-02-06 · Atualizado 2018-03-13 · CVE-2017-6201

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sandstorm versions prior to build 0.203

Description A Server Side Request Forgery issue exists in the install app process. A remote attacker may exploit this by providing a URL, potentially bypassing access control such as firewalls that prevent direct access to the URLs.

Recommendations For versions prior to build 0.203, update to build 0.203 or later to resolve the issue. As a temporary workaround, consider restricting access to the install app process to minimize the risk of exploitation.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2017-6201

Produtos afetados

Sandstorm

Referências · 5

• 🔥 https://sandstorm.io/news/2017-03-02-security-review · Exploit
• 🔥 https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en · Exploit
• https://github.com/sandstorm-io/sandstorm/commit/164997fb958effbc90c5328c166706280a84aaa1 · Correção
• https://osv.dev/vulnerability/CVE-2017-6201 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6201 · Nota de Segurança