PT-2022-24469 · Zalando · Zalando Skipper

Hossein Vita + 1 · Published 2022-10-24 · Updated 2023-03-28 · CVE-2022-38580

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zalando Skipper versions prior to v0.13.237

Description The issue allows an attacker to exploit a vulnerable version of the proxy to access the internal metadata server or other unauthenticated URLs by adding a specific header (X-Skipper-Proxy) to the HTTP request. This is a case of Server-Side Request Forgery (SSRF).

Recommendations To resolve the issue, upgrade to Zalando Skipper version v0.13.237 or later. As a temporary workaround, consider using the dropRequestHeader("X-Skipper-Proxy") filter to mitigate the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-38580

GHSA-F2RJ-M42R-6JM2

GO-2022-1086

Affected Products

Zalando Skipper

References · 17

• 🔥 https://gist.github.com/Fadavvi/9fffcfa4aaa9e25b77cfe7b3044b2857#file-cve-2022-38580 · Exploit
• 🔥 https://exploit-db.com/exploits/51111 · Exploit
• http://zalando.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38580 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38580 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f2rj-m42r-6jm2 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1086 · Vendor Advisory
• https://github.com/zalando/skipper · Note
• https://github.com/zalando/skipper/security/advisories/GHSA-f2rj-m42r-6jm2 · Note
• https://github.com/zalando/skipper/commit/842634347da8fe77e396f66edea79d329fd72130 · Note
• https://github.com/zalando/skipper/releases/tag/v0.13.237 · Note
• https://github.com/zalando/skipper/pull/2058 · Note
• http://packetstormsecurity.com/files/171546/X-Skipper-Proxy-0.13.237-Server-Side-Request-Forgery.html · Note
• https://t.me/cibsecurity/52032 · Telegram Post
• https://pkg.go.dev/vuln/GO-2022-1086 · Note