Skip to main content

Server-Side Request Forgery (SSRF)

CVE-2024-52588

High
7.5/10

Summary

A vulnerability was found in Strapi's Webhook functionality. The application permits users to input URLs, including local addresses such as "localhost", "127.0.0.1", and "0.0.0.0", when creating a webhook connection. This behavior can be exploited to perform Server-Side Request Forgery (SSRF), allowing attackers to initiate requests to internal services that are otherwise inaccessible externally. By leveraging this vulnerability, an attacker could conduct internal port scanning to identify open ports and services running within the host environment. This vulnerability affects @strapi/admin package versions 4.0.0-beta through 4.25.1, 5.0.0-alpha.0 through 5.0.0-beta.14.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-918 - Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.

References

Advisory Timeline

  • Published