PT-2018-8319 · Sandstorm · Sandstorm

Shaolin · Published 2018-02-06 · Updated 2018-03-13 · CVE-2017-6201

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sandstorm versions prior to build 0.203

Description A Server Side Request Forgery issue exists in the install app process. A remote attacker may exploit this by providing a URL, potentially bypassing access control such as firewalls that prevent direct access to the URLs.

Recommendations For versions prior to build 0.203, update to build 0.203 or later to resolve the issue. As a temporary workaround, consider restricting access to the install app process to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2017-6201

Affected Products

Sandstorm

References · 5

• 🔥 https://sandstorm.io/news/2017-03-02-security-review · Exploit
• 🔥 https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en · Exploit
• https://github.com/sandstorm-io/sandstorm/commit/164997fb958effbc90c5328c166706280a84aaa1 · Patch
• https://osv.dev/vulnerability/CVE-2017-6201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6201 · Security Note