PT-2024-24331 · Apache · Apache Streampipes

L0Ne1Y · CVE-2024-31979 · Published 2024-07-17 · Updated 2024-08-01

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache StreamPipes versions through 0.93.0

Description A Server-Side Request Forgery (SSRF) issue exists in Apache StreamPipes during the installation process of pipeline elements. The software allowed users to configure custom endpoints for installing additional pipeline elements, but these endpoints were not properly validated. This allowed an attacker to get StreamPipes to send an HTTP GET request to an arbitrary address.

Recommendations For Apache StreamPipes versions through 0.93.0, upgrade to version 0.95.0, which fixes the issue.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-31979

GHSA-9GR7-GH74-QG9X

PYSEC-2024-174

Affected Products

Apache Streampipes

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31979.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-31979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31979 · Security Note
• https://lists.apache.org/thread/8lryp3bxnby9kmk13odkz2jbfdjfvf0y · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9gr7-gh74-qg9x · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-174 · Vendor Advisory
• https://github.com/apache/streampipes · Note
• https://github.com/apache/streampipes/releases/tag/release%2F0.95.0 · Note
• https://github.com/apache/streampipes/commit/cd5a7b46e3383573f0f2b51da4b7306d4936aa3f · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/streampipes/PYSEC-2024-174.yaml · Note
• https://github.com/advisories/GHSA-9gr7-gh74-qg9x · Note
• https://t.me/cvedetector/1073 · Telegram Post
• http://openwall.com/lists/oss-security/2024/07/16/11 · Note