PT-2024-4001 · Portainer+1 · Portainer+1

Published 2024-04-25 · Updated 2024-10-31 · CVE-2024-33661

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Portainer versions prior to 2.20.0

Description The issue is related to the use of open redirects in the Portainer container management platform. This could allow an attacker to redirect a user to an arbitrary site. The problem is associated with Server-Side Request Forgery (SSRF), a security vulnerability that enables an attacker to induce the server-side application to make HTTP requests to unintended destinations, potentially leading to unauthorized access to internal resources.

Recommendations For Portainer versions prior to 2.20.0, update to version 2.20.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable redirect functionality until a patch is applied. Avoid using the redirect feature in Portainer until the issue is resolved.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2024-04424

CVE-2024-33661

Affected Products

Portainer

Red Os

References · 11

• https://github.com/portainer/portainer/pull/11236 · Patch
• https://github.com/portainer/portainer/pull/11233 · Patch
• https://bdu.fstec.ru/vul/2024-04424 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-33661 · Security Note
• https://osv.dev/vulnerability/CVE-2024-33661 · Vendor Advisory
• https://github.com/portainer/portainer/compare/2.19.4...2.20.0 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://portainer.io · Note
• https://t.me/secharvester/17419 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-portainer-ce-cve-2024-33661 · Note
• https://t.me/cvenotify/78065 · Telegram Post