PT-2023-4828 · Unknown · Request-Baskets

Beet1E

·

Publicado

2023-02-27

·

Atualizado

2025-02-01

·

CVE-2023-27163

CVSS v2.0

8.8

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions request-baskets versions up to v1.2.1
Description The issue is related to a Server-Side Request Forgery (SSRF) vulnerability via the component "/api/baskets/{name}". This allows attackers to access network resources and sensitive information by sending a crafted API request. The vulnerability is due to insufficient validation of incoming requests when handling the {name} parameter.
Recommendations For request-baskets versions up to v1.2.1, as a temporary workaround, consider disabling the /api/baskets/{name} endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the {name} parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2023-05313
CVE-2023-27163
GHSA-58G2-VGPG-335Q

Produtos afetados

Request-Baskets