CVE-2024-25738: VuFind Server-Side Request Forgery (SSRF) vulnerability
Summary
CVE-2024-25738: VuFind Server-Side Request Forgery (SSRF) vulnerability. Affects vufind/vufind versions >= 2.0, < 9.1.1. Fixed in 9.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
VuFind is an open-source library management system that provides a web-based interface for searching and accessing library resources. It is widely used by libraries and institutions to manage their collections and facilitate user access. This vulnerability affects VuFind versions 2.0 through 9.1 before 9.1.1. The vulnerability allows a remote attacker to exploit a Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route, leading to the overwrite of local configuration files. This can grant unauthorized access to the administrator panel and potentially enable Remote Code Execution. It is important to note that the vulnerability requires the allow_url_include PHP runtime setting to be enabled, which is typically disabled in default installations. Additionally, the /Upgrade route, which is exposed by default after installing VuFind, is recommended to be disabled by setting autoConfigure to false in config.ini.
Vulnerability Detail
The vulnerability arises due to a Server-Side Request Forgery (SSRF) issue in the /Upgrade/FixConfig route of VuFind. By exploiting this vulnerability, a remote attacker can manipulate the application to make arbitrary requests to internal resources or external systems. This can lead to various security risks, including unauthorized access to sensitive information, data leakage, and potential Remote Code Execution. The impact of this vulnerability is critical, with a CVSS score of 9.1.
How To Fix
Minimum fixed version
9.1.1
This is the first release that contains the fix.
composer require vufind/vufind:9.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the latest version is not immediately feasible, it is recommended to disable the /Upgrade route manually. This can be done by setting autoConfigure to false in the config.ini file. Additionally, ensure that the allow_url_include PHP runtime setting is disabled by modifying the PHP configuration file (php.ini) and setting allow_url_include to Off.
Conclusion
In conclusion, the VuFind Server-Side Request Forgery (SSRF) vulnerability poses a critical security risk, potentially leading to unauthorized access and Remote Code Execution. It is crucial to upgrade to the latest version of VuFind, apply the necessary patches, and disable the vulnerable routes and PHP runtime settings. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vufind/vufind →
FAQ
VuFind is an open-source library management system that provides a web-based interface for searching and accessing library resources.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to manipulate an application into making arbitrary requests to internal resources or external systems.
The vulnerability can lead to unauthorized access to sensitive information, data leakage, and potential Remote Code Execution.
To fix this vulnerability, upgrade to VuFind version 9.1.1 or later, disable the allow_url_include PHP runtime setting, and disable the /Upgrade route.
Yes, you can manually disable the /Upgrade route and ensure that the allow_url_include PHP runtime setting is disabled.
Related vulnerabilities
Recent vulnerabilities recorded for vufind/vufind.
