PT-2024-21119 · Open Library Foundation · Vufind

Rob · Published 2024-05-22 · Updated 2024-11-12 · CVE-2024-25737

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open Library Foundation VuFind versions 2.4 through 9.1 before 9.1.1

Description A Server-Side Request Forgery (SSRF) vulnerability in the "/Cover/Show" route, specifically in the showAction function of CoverController.php, allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks. This is achieved by proxying arbitrary URLs via the proxy GET parameter.

Recommendations For Open Library Foundation VuFind versions 2.4 through 9.1 before 9.1.1, update to version 9.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the "/Cover/Show" route or disabling the showAction function in CoverController.php until a patch is available. Avoid using the proxy GET parameter in the affected API endpoint until the issue is resolved.

Fix

SSRF

XSS

Weakness Enumeration

CWE-918

CWE-79

Related Identifiers

CVE-2024-25737

GHSA-FWHC-MM9Q-MQQ8

Affected Products

Vufind

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-25737 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25737 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fwhc-mm9q-mqq8 · Vendor Advisory
• https://github.com/vufind-org/vufind · Note
• https://github.com/vufind-org/vufind/commit/51f2ddac0dc1047e6fd3b27e6d984b19e1601d00 · Note
• https://github.com/vufind-org/vufind/commit/345d00f7d7f1c581f46742effdac70e803b3847b · Note
• https://vufind.org/wiki/security:cve-2024-25737 · Note
• https://t.me/cvenotify/80775 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1793379710766088606 · Twitter Post
• https://t.me/pentestingnews/47406 · Telegram Post
• https://twitter.com/CVEnew/status/1793384167691931722 · Twitter Post