PT-2024-29579 · Txtdot · Txtdot

Ouuan · Published 2024-07-26 · Updated 2024-09-30 · CVE-2024-41812

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions txtdot versions prior to 1.7.0 txtdot version 1.7.0

Description The issue concerns a Server-Side Request Forgery (SSRF) vulnerability in the /get route, allowing remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network.

Recommendations For versions prior to 1.7.0, update to version 1.7.0 or later. For version 1.7.0, set a firewall between txtdot and other internal network resources to prevent exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-41812

GHSA-4GJ5-XJ97-J8FP

Affected Products

Txtdot

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41812.json · Exploit
• 🔥 https://github.com/TxtDot/txtdot/security/advisories/GHSA-4gj5-xj97-j8fp · Exploit
• https://github.com/TxtDot/txtdot/commit/7c72d985f7a26ec1fd3cf628444717ca54986d2d · Patch
• https://github.com/TxtDot/txtdot/blob/a7fdaf80fdf45abefe83b2eb5135ba112142dc74/src/handlers/distributor.ts#L43-L47 · Patch
• https://osv.dev/vulnerability/CVE-2024-41812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41812 · Security Note
• https://t.me/cvedetector/1697 · Telegram Post