PT-2022-15829 · Recipes · Recipes

Published 2022-06-19 · Updated 2022-06-28 · CVE-2022-23071

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Recipes versions 0.9.1 through 1.2.5

Description The issue concerns Server Side Request Forgery (SSRF) in the "Import Recipe" functionality. When an attacker enters the localhost URL, a low-privileged attacker can access or read the internal file system to obtain sensitive information.

Recommendations For versions 0.9.1 through 1.2.5, consider disabling the "Import Recipe" functionality until a patch is available to prevent exploitation. Restrict access to the internal file system to minimize the risk of sensitive information disclosure.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-23071

Affected Products

Recipes

References · 6

• 🔥 https://mend.io/vulnerability-database/CVE-2022-23071 · Exploit
• https://github.com/TandoorRecipes/recipes/commit/d48fe26a3529cc1ee903ffb2758dfd8f7efaba8c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23071 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23071 · Vendor Advisory
• https://t.me/cvenotify/31871 · Telegram Post
• https://t.me/cvenotify/32301 · Telegram Post