PT-2024-20114 · Truelayer · Truelayer.Client+1

Foldedbits · Published 2024-01-30 · Updated 2024-02-08 · CVE-2024-23838

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TrueLayer.Client versions prior to v1.6.0

Description The issue could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made, which could lead to information disclosure. The issue can be mitigated by having strict egress rules limiting the destinations to which requests can be made, and applying strict validation to any user input passed to the truelayer-dotnet library.

Recommendations For versions prior to v1.6.0, consider having strict egress rules limiting the destinations to which requests can be made, and apply strict validation to any user input passed to the truelayer-dotnet library as a temporary workaround. Update to version v1.6.0 or later to resolve the issue.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-23838

GHSA-67M4-QXP3-J6HH

Affected Products

Truelayer.Client

Truelayer-Dotnet

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23838.json · Exploit
• https://github.com/TrueLayer/truelayer-dotnet/security/advisories/GHSA-67m4-qxp3-j6hh · Vendor Advisory
• https://github.com/TrueLayer/truelayer-dotnet/commit/75e436ed5360faa73d6e7ce3a9903a3c49505e3e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-23838 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23838 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67m4-qxp3-j6hh · Vendor Advisory
• https://github.com/TrueLayer/truelayer-dotnet · Note
• https://twitter.com/VulmonFeeds/status/1752414788804579407 · Twitter Post
• https://twitter.com/CVEnew/status/1752371321231581651 · Twitter Post