PT-2023-30181 · Posthog · Posthog

Sylwia Budzynska + 1 · Published 2023-12-01 · Updated 2023-12-11 · CVE-2023-46746

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PostHog versions prior to the version including commit 22bd5942

Description A server-side request forgery (SSRF) issue was found in PostHog, which can be exploited by authenticated users. The issue arises because PostHog did not verify whether a URL was local when enabling webhooks, allowing authenticated users to forge a POST request.

Recommendations For versions prior to the version including commit 22bd5942, update to a version that includes the fix commit 22bd5942 to resolve the issue. As a temporary workaround, consider disabling the webhooks feature until a patched version is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-46746

GHSA-WQQW-R8C5-J67C

Affected Products

Posthog

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46746.json · Exploit
• https://github.com/PostHog/posthog/commit/22bd5942638d5d9bc4bd603a9bfe8f8a95572292 · Patch
• https://github.com/PostHog/posthog/security/advisories/GHSA-wqqw-r8c5-j67c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46746 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46746 · Vendor Advisory
• https://securitylab.github.com/advisories/GHSL-2023-185_posthog_posthog · Note
• https://t.me/cvenotify/61966 · Telegram Post
• https://t.me/cvenotify/62612 · Telegram Post
• https://t.me/cvenotify/63208 · Telegram Post