PT-2019-18683 · Thehive · Cortex-Analyzers+1

Alexandre Basquin · Published 2019-05-09 · Updated 2019-05-13 · CVE-2019-7652

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TheHive Project UnshortenLink analyzer versions prior to 1.1 Cortex-Analyzers versions prior to 1.15.2

Description The issue allows for Server-Side Request Forgery (SSRF) attacks. An attacker can exploit this by creating a new analysis, selecting URL for Data Type, and providing an SSRF payload in the Data parameter, such as "http://127.0.0.1:22". The result of the attack can be seen in the main dashboard, enabling potential port scans on localhost and intranet hosts.

Recommendations For TheHive Project UnshortenLink analyzer versions prior to 1.1, update to version 1.1 or later. For Cortex-Analyzers versions prior to 1.15.2, update to version 1.15.2 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2019-7652

Affected Products

Cortex-Analyzers

Thehive Project Unshortenlink Analyzer

References · 5

• 🔥 https://exploit-db.com/exploits/46820 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-7652 · Security Note
• https://blog.thehive-project.org/2019/02/11/unshortenlink-ssrf-and-cortex-analyzers-1-15-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-7652 · Vendor Advisory
• http://packetstormsecurity.com/files/152804/TheHive-Project-Cortex-2.1.3-Server-Side-Request-Forgery.html · Note