PT-2024-24092 · Plane · Plane

Sylwia-Budzynska · Published 2024-04-10 · Updated 2024-04-24 · CVE-2024-31461

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Plane versions prior to 0.17-dev

Description The issue is a Server-Side Request Forgery (SSRF) vulnerability that may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized access to internal systems. The impact includes unauthorized access to internal services, potential leakage of sensitive information, and manipulation of internal systems by interacting with internal APIs.

Recommendations For versions prior to 0.17-dev, update to version 0.17-dev to resolve the issue. As a temporary workaround, consider restricting outgoing network connections from servers hosting the application to essential services only. Additionally, implement strict input validation on URLs or parameters that are used to generate server-side requests.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-31461

GHSA-J77V-W36V-63V6

Affected Products

Plane

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31461.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-31461 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31461 · Vendor Advisory
• https://github.com/makeplane/plane/security/advisories/GHSA-j77v-w36v-63v6 · Note
• https://github.com/makeplane/plane/commit/4b0ccea1461b7ca38761dfe0d0f07c2f94425005 · Note
• https://github.com/makeplane/plane/pull/3333 · Note
• https://github.com/makeplane/plane/commit/d887b780aea5efba3f3d28c47d7d83f8b3e1e21c · Note
• https://github.com/makeplane/plane/pull/3323 · Note
• https://securitylab.github.com/advisories/GHSL-2023-257_makeplane_plane · Note
• https://twitter.com/GHSecurityLab/status/1781007799025025101 · Twitter Post
• https://twitter.com/CVEnew/status/1778118876661723435 · Twitter Post
• https://t.me/cvenotify/77456 · Telegram Post
• https://t.me/pentestingnews/46209 · Telegram Post