CVE-2019-9827 Server-Side Request Forgery in Hawt Hawtio

What is CVE-2019-9827?

CVE-2019-9827 is a critical server-side request forgery vulnerability in n/a, published on 3 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.

Weakness: CWE-918

Which versions are affected by CVE-2019-9827?

2 open source packages ship an affected version, including io.hawt:hawtio-core. It affects 1 product.

Products include Hawt Hawtio.

How do I fix CVE-2019-9827?

Upgrade io.hawt:hawtio-core to 2.5.0 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2019-9827 being exploited?

There is no known exploitation of CVE-2019-9827 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2014-0121 Missing authorization in n/a Critical 9.8
• CVE-2014-0120 Cross-site request forgery in n/a High 8.8
• CVE-2017-7556 Cross-Site Request Forgery in hawtio High 8.8
• CVE-2017-2589 Insecure cookie sharing in Hawtio High 8.7
• CVE-2017-2617 File upload in hawtio High 7.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mcg9-64cp-xwp7.