CVE-2019-16752 Server-side request forgery in n/a
Attackers can force cryptocurrency wallets to send HTTP requests to arbitrary locations, potentially leaking user IP addresses and privacy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-16752?
CVE-2019-16752 is a medium-severity server-side request forgery vulnerability in n/a, published on 4 Dec 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wallets to send HTTP requests to arbitrary locations, both on the local network and on the internet. This is a serious threat to user privacy, since it can possibly leak their IP address and the fact that they are using the product. This also affects Dash Core through 0.14.0.3 and Private Instant Verified Transactions (PIVX) through 3.4.0.
Weakness: CWE-352
Which versions are affected by CVE-2019-16752?
It affects 3 products.
Products include Dash Dash Core, Officialdapscoin Decentralized Anonymous Payment System, Pivx Private Instant Verified Transactions.
How do I fix CVE-2019-16752?
No fix has been published for CVE-2019-16752 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2019-16752 being exploited?
There is no known exploitation of CVE-2019-16752 in the wild and no public exploit code.
Sources
Also known as GHSA-rpw6-pjfj-6x6g.