PT-2024-30535 · Unknown+3 · Ckanext-Archiver+5

Senzee1984 · Published 2024-08-21 · Updated 2024-08-23 · CVE-2024-43371

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.10.5 CKAN versions prior to 2.11.0

Description CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy, and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents. All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it, known as a Server Side Request Forgery. Users wanting to protect against these kinds of attacks can use one or a combination of the following approaches: (1) Use a separate HTTP proxy like Squid that can be used to allow/disallow IPs, domains, etc., as needed, and make CKAN extensions aware of this setting via the ckan.download proxy config option. (2) Implement custom firewall rules to prevent access to restricted resources. (3) Use custom validators on the url field to block/allow certain domains or IPs.

Recommendations For CKAN versions prior to 2.10.5, use a separate HTTP proxy like Squid to allow/disallow IPs, domains, etc., as needed, and make CKAN extensions aware of this setting via the ckan.download proxy config option. For CKAN versions prior to 2.11.0, implement custom firewall rules to prevent access to restricted resources. For all affected versions, use custom validators on the url field to block/allow certain domains or IPs.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-43371

GHSA-G9PH-J5VJ-F8WM

Affected Products

Ckan

Datapusher

Resource Proxy

Squid

Xloader

Ckanext-Archiver

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43371.json · Exploit
• https://github.com/ckan/ckan/security/advisories/GHSA-g9ph-j5vj-f8wm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43371 · Security Note
• https://osv.dev/vulnerability/GHSA-g9ph-j5vj-f8wm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43371 · Vendor Advisory
• https://github.com/ckan/ckan · Note
• https://github.com/ckan/ckan/commit/382beaec98cb331f2a030459ef043c50eaf5ad53 · Note
• https://github.com/ckan/ckan/commit/8601183cc2fc87277ea5b33ff75c3a5610812ab5 · Note
• https://twitter.com/VulmonFeeds/status/1826299204689449450 · Twitter Post
• https://twitter.com/CVEnew/status/1826280533267005567 · Twitter Post
• https://t.me/cvedetector/3772 · Telegram Post
• https://t.me/cvenotify/91951 · Telegram Post