CVE-2019-10648 Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction
Remote attackers can trigger external DNS interactions via URL streams, potentially leaking information or bypassing network restrictions in Robocode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10648?
CVE-2019-10648 is a critical server-side request forgery vulnerability in n/a, published on 30 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
Weakness: CWE-862
Which versions are affected by CVE-2019-10648?
2 open source packages ship an affected version, including net.sf.robocode:robocode.host. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
net.sf.robocode:robocode.host Maven | All versions | 1.9.3.7 |
net.sf.robocode:robocode.host Maven | All versions | 1.9.3.7 |
Products include Robocode Robocode.
How do I fix CVE-2019-10648?
Upgrade net.sf.robocode:robocode.host to 1.9.3.7 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2019-10648 being exploited?
There is no known exploitation of CVE-2019-10648 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2019-10648, GHSA-q2xp-75m7-gv52, UBUNTU-CVE-2019-10648.