blog.orange.tw
https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html CVE-2017-18638
Nuclei
graphite.composer.views.send_email vulnerable to SSRF
Record summary
EIP currently links 1 Nuclei template to CVE-2017-18638.
Description
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
graphite-webBrowse PyPI / graphite-web | GitHub Advisory | Before 1.1.6 · Fixed in 1.1.6 | affected |
Nuclei templates
1ProjectDiscoveryHIGHGraphite <=1.1.5 - Server-Side Request ForgeryCVSS 7.5
Graphite's send_email in graphite-web/webapp/graphite/composer/views.py in versions up to 1.1.5 is vulnerable to server-side request forgery (SSR)F. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an email address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
Impact
An attacker can exploit this vulnerability to access internal resources, potentially leading to unauthorized access, data leakage, or further attacks.
Remediation
Upgrade to a patched version of Graphite (>=1.1.6) or apply the necessary security patches.
WeaknessesCWE-918
Authorshuowuzhao
Template tagscvecve2017graphitessrfoastgraphite_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:graphite_project:graphite:*:*:*:*:*:*:*:*
http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html https://github.com/graphite-project/graphite-web/issues/2008 https://github.com/advisories/GHSA-vfj6-275q-4pvm https://nvd.nist.gov/vuln/detail/CVE-2017-18638 https://github.com/graphite-project/graphite-web/pull/2499
Source: ProjectDiscovery
References
10github.com
https://github.com/graphite-project/graphite-web github.com
https://github.com/graphite-project/graphite-web/commit/71726a0e41a5263f49b973a7b856505a5b931c1f github.com
https://github.com/graphite-project/graphite-web/issues/2008 github.com
https://github.com/graphite-project/graphite-web/pull/2499 github.com
https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm github.com
https://github.com/pypa/advisory-database/tree/main/vulns/graphite-web/PYSEC-2019-151.yaml [debian-lts-announce] 20191021 [SECURITY] [DLA 1962-1] graphite-web security updatemailing list
https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2017-18638 youtube.com
https://www.youtube.com/watch?v=ds4Gp4xoaeA