CVE-2019-10686: Server-Side Request Forgery (SSRF) in com.ctrip.framework.apollo:apollo
Summary
CVE-2019-10686: Server-Side Request Forgery (SSRF) in com.ctrip.framework.apollo:apollo. Affects com.ctrip.framework.apollo:apollo versions < 1.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.ctrip.framework.apollo:apollo is a Maven package that provides functionality for Ctrip Apollo, a configuration management system. It allows users to manage and distribute application configurations across different environments. This package is vulnerable to a Server-Side Request Forgery (SSRF) attack.
Vulnerability Detail
The SSRF vulnerability in com.ctrip.framework.apollo:apollo allows an attacker to perform an intranet port scan or raise a GET request via the /system-info/health API. This vulnerability is due to mishandling of the %23 substring. An attacker can exploit this vulnerability to access internal resources, potentially leading to unauthorized access, data leakage, or further attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above.
Conclusion
The vulnerability in com.ctrip.framework.apollo:apollo allows for Server-Side Request Forgery (SSRF) attacks, which can lead to unauthorized access, data leakage, and further exploitation. It is crucial to upgrade to a non-affected version of the package to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.ctrip.framework.apollo:apollo →
FAQ
com.ctrip.framework.apollo:apollo is a Maven package that provides functionality for Ctrip Apollo, a configuration management system. It allows users to manage and distribute application configurations across different environments.
A Server-Side Request Forgery (SSRF) vulnerability is a type of security vulnerability where an attacker can make requests from the server to other internal or external resources. In this case, the vulnerability allows an attacker to perform an intranet port scan or raise a GET request via the /system-info/health API.
The potential consequences of this vulnerability include unauthorized access to internal resources, data leakage, and further attacks on the system.
Yes, a fix is available for this vulnerability. It is recommended to upgrade to a version of com.ctrip.framework.apollo:apollo that is not affected by this issue.
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above.
Related vulnerabilities
Recent vulnerabilities recorded for com.ctrip.framework.apollo:apollo.
