CVE-2020-9298: Server-Side Request Forgery in Spinnaker Orca
Summary
CVE-2020-9298: Server-Side Request Forgery in Spinnaker Orca. Affects com.netflix.spinnaker.orca:orca-core versions < 8.7.0. Fixed in 8.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spinnaker Orca is a package in the Maven ecosystem that provides template resolution functionality. It is used in the Spinnaker platform for orchestrating deployment pipelines. The package allows users to define and execute complex deployment workflows. However, a vulnerability in the template resolution functionality makes it susceptible to Server-Side Request Forgery (SSRF) attacks. An attacker can exploit this vulnerability to send requests on behalf of Spinnaker, potentially leading to sensitive data disclosure.
Vulnerability Detail
The vulnerability in Spinnaker Orca arises from its template resolution functionality. By manipulating the templates, an attacker can trick the application into making requests to arbitrary URLs. This can result in several security risks, including unauthorized access to internal resources, data leakage, and potential compromise of the entire Spinnaker platform. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
8.7.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable or restrict access to the template resolution functionality in Spinnaker Orca. This can be achieved by modifying the configuration or access controls to prevent unauthorized template resolution requests.
Conclusion
The Server-Side Request Forgery (SSRF) vulnerability in Spinnaker Orca's template resolution functionality can have severe consequences, including unauthorized access and data leakage. It is crucial to upgrade to the latest version of the package or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.netflix.spinnaker.orca:orca-core →
FAQ
Spinnaker Orca is a package in the Maven ecosystem that provides template resolution functionality for the Spinnaker platform. It is used for orchestrating deployment pipelines.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests on behalf of the server or application. In this case, the vulnerability in Spinnaker Orca enables an attacker to send requests from the application to arbitrary URLs.
The vulnerability in Spinnaker Orca can lead to unauthorized access to internal resources, data leakage, and compromise of the entire Spinnaker platform. It can also be used as a stepping stone for further attacks.
To fix this vulnerability, it is recommended to upgrade the Spinnaker Orca package to version 8.7.0 or above. This version includes a fix for the SSRF vulnerability.
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable or restrict access to the template resolution functionality in Spinnaker Orca.
