CVE-2023-41327: WireMock Webhooks Extension Server Side Request Forgery Vulnerability
Summary
CVE-2023-41327: WireMock Controlled Server Side Request Forgery vulnerability through URL. Affects org.wiremock:wiremock-webhooks-extension across 2 version ranges.
>= 2.0.0, < 2.35.1
>= 3.0.0, < 3.0.3
Fixed in 2.35.1 or 3.0.3, depending on the release line you run. How to fix ↓
Also tracked for
- wiremock · Bitnami
The same CVE-2023-41327 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WireMock is an open-source tool used for stubbing and mocking HTTP-based services. It allows developers to simulate and test API interactions. The WireMock Webhooks Extension is an add-on that enables the creation of webhooks for handling HTTP requests. This extension is vulnerable to a Server Side Request Forgery (SSRF) attack through the URL parameter.
Vulnerability Detail
The WireMock Webhooks Extension, until version 3.0.3, does not properly filter target addresses when processing webhooks. This means that an attacker can trigger a POST request from a webhook and forward it to an arbitrary service reachable from WireMock's instance. For example, if WireMock is running in a private cluster, an attacker can exploit this vulnerability to make internal POST requests to unsecured or even secured APIs by passing a token via authentication headers.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.35.12.35.1 -
>= 3.0.0, < 3.0.33.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A workaround for this vulnerability is to use external firewall rules to define a list of permitted destinations. By restricting the outgoing connections from WireMock's instance, the risk of SSRF attacks can be mitigated.
Conclusion
The WireMock Webhooks Extension is vulnerable to a Server Side Request Forgery (SSRF) attack, allowing an attacker to make unauthorized requests to internal or external APIs. To mitigate this vulnerability, it is crucial to upgrade to the latest patched versions and implement network restrictions. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.wiremock:wiremock-webhooks-extension →
FAQ
WireMock is an open-source tool used for stubbing and mocking HTTP-based services. It allows developers to simulate and test API interactions.
The WireMock Webhooks Extension is an add-on for WireMock that enables the creation of webhooks for handling HTTP requests.
A Server Side Request Forgery (SSRF) vulnerability allows an attacker to make requests from the server to arbitrary destinations, potentially bypassing security measures and accessing sensitive information.
An attacker can exploit this vulnerability by triggering a POST request from a webhook and forwarding it to an arbitrary service reachable from WireMock's instance. This can be used to make unauthorized requests to internal or external APIs.
To fix this vulnerability, it is recommended to upgrade to the latest version of WireMock or WireMock Webhooks Extension that includes the security patches. Additionally, set up network restrictions to prevent proxying and recording from specific target addresses.
