CVE-2017-7553 Server-side request forgery in n/a

Medium 6.3 Published 28 Sep 2017 Updated 5 Aug 2024

An SSRF vulnerability in Red Hat App Studio allows attackers to probe internal networks and access restricted endpoints via the external_request API.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-7553?

CVE-2017-7553 is a medium-severity server-side request forgery vulnerability in n/a, published on 28 Sep 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources, and access restricted endpoints.

Weakness: CWE-918

Which versions are affected by CVE-2017-7553?

It affects 1 product.

Products include Redhat Mobile Application Platform.

How do I fix CVE-2017-7553?

Apply the vendor's patch.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2017-7553 being exploited?

There is no known exploitation of CVE-2017-7553 in the wild and no public exploit code.

Sources

Also known as GHSA-rmmq-9vg2-553m.