PT-2023-30181 · Posthog · Posthog

Sylwia Budzynska + 1 · Publicado 2023-12-01 · Atualizado 2023-12-11 · CVE-2023-46746

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PostHog versions prior to the version including commit 22bd5942

Description A server-side request forgery (SSRF) issue was found in PostHog, which can be exploited by authenticated users. The issue arises because PostHog did not verify whether a URL was local when enabling webhooks, allowing authenticated users to forge a POST request.

Recommendations For versions prior to the version including commit 22bd5942, update to a version that includes the fix commit 22bd5942 to resolve the issue. As a temporary workaround, consider disabling the webhooks feature until a patched version is available.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2023-46746

GHSA-WQQW-R8C5-J67C

Produtos afetados

Posthog

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46746.json · Exploit
• https://github.com/PostHog/posthog/commit/22bd5942638d5d9bc4bd603a9bfe8f8a95572292 · Correção
• https://github.com/PostHog/posthog/security/advisories/GHSA-wqqw-r8c5-j67c · Aviso do Fabricante
• https://securitylab.github.com/advisories/GHSL-2023-185_posthog_posthog · Nota
• https://t.me/cvenotify/61966 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-46746 · Nota de Segurança
• https://t.me/cvenotify/62612 · Publicação no Telegram
• https://t.me/cvenotify/63208 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-46746 · Aviso do Fabricante