Lucene search

Veracode Vulnerability DatabaseVERACODE:40087

HistoryApr 10, 2023 - 2:25 a.m.

Server-side Request Forgery (SSRF)

2023-04-1002:25:37

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

822

server-side request forgery

ssrf

improper validation

api request

admin authenticated attacker

network resources

sensitive information

0.081 Low

EPSS

Percentile

94.4%

JSON

github.com/darklynx/request-baskets is vulnerable to Server-side Request Forgery (SSRF). The vulnerability exists due to the improper validation in the /api/baskets/{name} path, allowing an admin authenticated attacker to access network resources and sensitive information via a maliciously crafted API request.

CPENameOperatorVersion
github.com/darklynx/request-basketslev1.2.1
github.com/darklynx/request-basketslev1.2.1

CPE	Name	Operator	Version
	github.com/darklynx/request-baskets	le	v1.2.1
	github.com/darklynx/request-baskets	le	v1.2.1

References

packetstormsecurity.com/files/174128/Request-Baskets-1.2.1-Server-Side-Request-Forgery.html

packetstormsecurity.com/files/174129/Maltrail-0.53-Remote-Code-Execution.html

request-baskets.com

gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3

github.com/advisories/GHSA-58g2-vgpg-335q

github.com/darklynx/request-baskets

notes.sjtu.edu.cn/s/MUUhEymt7

0.081 Low

EPSS

Percentile

94.4%

JSON

Related for VERACODE:40087