PT-2022-15905 · Apache · Apache Traffic Control Traffic Ops

Walkerxiong · Published 2022-02-06 · Updated 2024-08-21 · CVE-2022-23206

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Traffic Control Traffic Ops versions prior to 6.1.0 Apache Traffic Control Traffic Ops versions prior to 5.1.6

Description The issue allows an unprivileged user who can reach Traffic Ops over HTTPS to send a specially-crafted POST request to "/user/login/oauth" to scan a port of a server that Traffic Ops can reach. This is a case of Server-Side Request Forgery.

Recommendations For versions prior to 6.1.0, update to version 6.1.0 or later. For versions prior to 5.1.6, update to version 5.1.6 or later. As a temporary workaround, consider restricting access to the "/user/login/oauth" endpoint until a patch is available.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-23206

GHSA-WP47-9R3H-XFGQ

GO-2022-0585

Affected Products

Apache Traffic Control Traffic Ops

References · 8

• https://lists.apache.org/thread/lsrd2mqj29vrvwsh8g0d560vvz8n126f · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wp47-9r3h-xfgq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23206 · Security Note
• https://osv.dev/vulnerability/GO-2022-0585 · Vendor Advisory
• https://github.com/advisories/GHSA-wp47-9r3h-xfgq · Note
• https://t.me/cvenotify/26341 · Telegram Post
• https://t.me/cibsecurity/36926 · Telegram Post