PT-2020-10387 · Openlambda · Openlambda

Pwn1Sher · Published 2020-01-02 · Updated 2021-07-21 · CVE-2019-20329

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenLambda (affected versions not specified)

Description The issue allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2019-20329

Affected Products

Openlambda

References · 5

• 🔥 https://github.com/open-lambda/open-lambda/blob/9f7f935195ca74700c60ebc1ecfdaefad40d144b/src/common/config.go#L135 · Exploit
• 🔥 https://github.com/open-lambda/open-lambda/blob/9f7f935195ca74700c60ebc1ecfdaefad40d144b/src/server/lambdaServer.go#L92-L97 · Exploit
• https://osv.dev/vulnerability/CVE-2019-20329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20329 · Security Note
• https://github.com/open-lambda/open-lambda/issues/92 · Note