PT-2024-34622 · Appsmith · Appsmith

Jahit Hoque · Published 2024-11-04 · Updated 2024-11-11 · CVE-2024-51408

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

Name of the Vulnerable Software and Affected Versions AppSmith Community versions 1.8.3 through 1.46

Description The issue allows for Server-Side Request Forgery (SSRF) via the New DataSource feature for application/json requests to the IP address 169.254.169.254, which is used to retrieve AWS metadata credentials. This can be exploited by attackers to access AWS credentials by manipulating internal server requests.

Recommendations For versions 1.8.3 through 1.45, update to version 1.46 to resolve the issue. As a temporary workaround, consider restricting access to the New DataSource feature until the update is applied. Avoid using the New DataSource feature for application/json requests to the IP address 169.254.169.254 until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-APPSMITH-2024-51408

CVE-2024-51408

Affected Products

Appsmith

References · 13

• 🔥 https://github.com/jahithoque/Vulnerability-Research/tree/main/CVE-2024-51408 · Exploit
• https://osv.dev/vulnerability/BIT-appsmith-2024-51408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51408 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51408 · Vendor Advisory
• https://github.com/appsmithorg/appsmith/pull/29286 · Note
• https://github.com/appsmithorg/appsmith/releases/tag/v1.46 · Note
• https://twitter.com/CveFindCom/status/1853437688755393009 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1855856413848789402 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1853489762247532551 · Twitter Post
• https://t.me/cvenotify/100864 · Telegram Post
• https://twitter.com/JahitHoque/status/1854143835246625276 · Twitter Post
• https://twitter.com/CVEnew/status/1853434899622928466 · Twitter Post
• https://t.me/cvedetector/9739 · Telegram Post