PT-2019-20061 · Terria · Terriajs-Server

Publicado 2019-05-29 · Atualizado 2019-05-29

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions terriajs-server versions prior to 2.7.4

Description The issue allows for Server-Side Request Forgery (SSRF) under specific conditions. If an attacker has access to a server whitelisted by the terriajs-server proxy, or if they can modify the DNS records of a whitelisted domain, they can exploit the terriajs-server proxy to access any HTTP-accessible resources available to the server. This includes private resources within the hosting environment.

Recommendations Upgrade to version 2.7.4 or later.

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

GHSA-P72P-RJR2-R439

Produtos afetados

Terriajs-Server

Referências · 4

• https://github.com/TerriaJS/terriajs-server/commit/3cbc48475f50a53962f605491d0e60648a29bdf0 · Nota
• https://npmjs.com/advisories/768 · Nota
• https://medium.com/terria/security-vulnerability-in-terriajs-server-82c8bf4da0a5 · Nota
• https://osv.dev/vulnerability/GHSA-p72p-rjr2-r439 · Aviso do Fabricante