CVE-2024-25737: VuFind Server-Side Request Forgery (SSRF) vulnerability in vufind/vufind
Summary
CVE-2024-25737: VuFind Server-Side Request Forgery (SSRF) vulnerability. Affects vufind/vufind versions >= 2.4, < 9.1.1. Fixed in 9.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
VuFind is an open-source library management system that provides a user-friendly interface for searching and accessing library resources. It is widely used by libraries and institutions to manage their collections and facilitate user access. The vulnerability in question affects versions 2.4 through 9.1.1 of the vufind/vufind package.
Vulnerability Detail
The vulnerability is a Server-Side Request Forgery (SSRF) issue that exists in the /Cover/Show route (showAction in CoverController.php) of VuFind. It allows remote attackers to exploit the application's functionality to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks. This is achieved by proxying arbitrary URLs via the proxy GET parameter. The impact of this vulnerability can be severe, as it enables unauthorized access to internal resources and the potential for executing malicious code.
How To Fix
Minimum fixed version
9.1.1
This is the first release that contains the fix.
composer require vufind/vufind:9.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the affected route or implementing input validation and sanitization to prevent the proxying of arbitrary URLs. Here is an example of how to disable the route in the application's routing configuration:
// app/config/routing.yml
cover_show:
path: /Cover/Show
defaults: { _controller: 'AppBundle:Cover:show', _method: 'GET' }
methods: [GET]
requirements:
_format: html
Conclusion
The VuFind package is affected by a critical Server-Side Request Forgery (SSRF) vulnerability that allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks. To mitigate this vulnerability, it is crucial to upgrade to version 9.1.1 or later of the vufind/vufind package. If immediate upgrading is not possible, implementing the provided workaround or taking appropriate security measures is recommended. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vufind/vufind →
FAQ
VuFind is an open-source library management system that provides a user-friendly interface for searching and accessing library resources. It is widely used by libraries and institutions to manage their collections and facilitate user access.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests from the vulnerable server to other internal or external resources. In this case, the SSRF vulnerability in VuFind enables attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks.
The vulnerability allows unauthorized access to internal resources and the potential for executing malicious code. Attackers can exploit this vulnerability to perform various attacks, such as accessing sensitive data, compromising user accounts, or injecting malicious scripts.
To fix this vulnerability, it is recommended to upgrade to version 9.1.1 or later of the vufind/vufind package. This version includes the necessary patches and security enhancements to mitigate the SSRF vulnerability.
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the affected route or implementing input validation and sanitization to prevent the proxying of arbitrary URLs.
References
Related vulnerabilities
Recent vulnerabilities recorded for vufind/vufind.
