CVE-2023-25557

CRITICAL Year: 2023
CVSS v3 Score
9.1
Critical
Weakness Type
CWE-918
View all →

Vulnerability Description

DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this proxy is to perform authentication if needed and forward HTTP requests to the DataHub Metadata Store (GMS). It has been discovered that the proxy does not adequately construct the URL when forwarding data to GMS, allowing external users to reroute requests from the DataHub Frontend to any arbitrary hosts. As a result attackers may be able to reroute a request from originating from the frontend proxy to any other server and return the result. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-076.

Related Vulnerabilities

CVE-2017-14611

CRITICAL
CVSS:9.1(Critical)

SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued ahe...

CWE-9182017

CVE-2018-1000138

CRITICAL
CVSS:9.1(Critical)

I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or upda...

CWE-9182018

CVE-2018-16444

CRITICAL
CVSS:9.1(Critical)

An issue was discovered in SeaCMS 6.61. adm1n/admin_reslib.php has SSRF via the url parameter.

CWE-9182018

CVE-2018-19601

CRITICAL
CVSS:9.1(Critical)

Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

CWE-9182018

CVE-2018-9302

CRITICAL
CVSS:9.1(Critical)

SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter....

CWE-9182018

CVE-2019-12994

CRITICAL
CVSS:9.1(Critical)

Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.

CWE-9182019