PT-2022-13961 · Unknown+1 · Krakend-Ce+2

Fepame + 1 · Published 2022-08-01 · Updated 2022-08-08 · CVE-2022-1561

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lura versions prior to 2.0.2 KrakenD-CE versions prior to 2.0.2 KrakenD-EE versions prior to 2.0.0

Description The issue arises from incorrect sanitization of URL parameters, allowing malicious users to alter the backend URL defined for a pipe when remote users send specially crafted URL requests. This does not affect KrakenD itself but may impact the consumed backend.

Recommendations For Lura versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue. For KrakenD-CE versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue. For KrakenD-EE versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-471

Related Identifiers

CVE-2022-1561

Affected Products

Krakend-Ce

Krakend-Ee

Lura

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-1561 · Security Note
• https://krakend.io/blog/cve-2022-1561-crafted-backend-urls · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1561 · Vendor Advisory
• https://t.me/cvenotify/34077 · Telegram Post
• https://incibe-cert.es/en/early-warning/security-advisories/crafted-backend-urls-lura-project · Note