PT-2024-29495 · Unknown · Cbioportal

Boonking1220 · Published 2024-07-23 · Updated 2024-07-24 · CVE-2024-41668

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions cBioPortal versions prior to 6.0.12

Description The cBioPortal for Cancer Genomics provides visualization, analysis, and download of large-scale cancer genomics data sets. When running a publicly exposed proxy endpoint without authentication, cBioPortal could allow someone to perform a Server Side Request Forgery (SSRF) attack. Logged in users could do the same on private instances.

Recommendations For versions prior to 6.0.12, update to version 6.0.12 to resolve the issue. As a temporary workaround, consider disabling the "/proxy" endpoint entirely via, for example, nginx.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-41668

GHSA-9H44-R3C3-Q7RM

Affected Products

Cbioportal

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41668.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-41668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41668 · Security Note
• https://github.com/cBioPortal/cbioportal/commit/ea8642fdbda2d61d2ab34b9da7a1594680bbbcd5 · Note
• https://github.com/cBioPortal/cbioportal/security/advisories/GHSA-9h44-r3c3-q7rm · Note
• https://github.com/cBioPortal/cbioportal/releases/tag/v6.0.12 · Note
• https://github.com/cBioPortal/cbioportal/pull/10884 · Note
• https://t.me/cvenotify/87169 · Telegram Post
• https://t.me/cvedetector/1525 · Telegram Post
• https://wizlynxgroup.com/security-research-advisories/vuln/WLX-2024-004 · Note