Server-side Request Forgery (SSRF)

github.com/zalando/skipper is vulnerable to server-side request forgery. The vulnerability exists because proxy.go does not properly pass URLs via the request context, allowing an attacker to redirect to the malicious URLs through the X-Skipper-Proxy header...

Skipper vulnerable to SSRF via X-Skipper-Proxy

Impact Skipper prior to version v0.13.236 is vulnerable to server-side request forgery SSRF. An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header X-Skipper-Proxy to the http request. Patches The...

GHSA-F2RJ-M42R-6JM2 Skipper vulnerable to SSRF via X-Skipper-Proxy

Impact Skipper prior to version v0.13.236 is vulnerable to server-side request forgery SSRF. An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header X-Skipper-Proxy to the http request. Patches The...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

Server side request forgery (ssrf)

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

Skipper 代码问题漏洞

Skipper is an HTTP router and reverse proxy for service portfolios. A security vulnerability exists in Zalando Skipper version v0.13.236 that stems from vulnerability to server-side request forgery SSRF attacks...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

PT-2022-24469 · Zalando · Zalando Skipper

Name of the Vulnerable Software and Affected Versions: Zalando Skipper versions prior to v0.13.237 Description: The issue allows an attacker to exploit a vulnerable version of the proxy to access the internal metadata server or other unauthenticated URLs by adding a specific header X-Skipper-Prox...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF) via the X-Skipper-Proxy header. Multiple sources (Red Hat, OSV, ExploitDB, GHSA advisory) describe an SSRF condition allowing an attacker to access internal endpoints (e.g., AWS metadata) by sending requests with a craf...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

Cross-site Scripting (XSS)

github.com/zalando/skipper is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization allowing an attacker to bypass a query predicate via a maliciously crafted request...

GHSA-QX2J-85Q5-FFP8 Query predicate bypass in Zalando Skipper

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

Query predicate bypass in Zalando Skipper

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

CVE-2022-34296

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

CVE-2022-34296

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

Cross site request forgery (csrf)

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

Skipper 安全漏洞

Skipper is an HTTP router and reverse proxy for service portfolios. A security vulnerability exists in Skipper versions prior to 0.13.218, which stems from a lack of valid filter escaping for application query predicates...

CVE-2022-34296

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

CVE-2022-34296

CVE-2022-34296 affects the Zalando Skipper HTTP router/reverse proxy. In Skipper versions before 0.13.218, a flaw allows bypass of a query predicate via a prepared request, due to insufficient escaping/validation of application query predicates. This could enable an attacker to bypass predicate c...