CVE-2020-5412 Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard
Attackers can exploit the Hystrix Dashboard proxy endpoint to perform Server-Side Request Forgery, accessing internal servers not intended for public exposure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-5412?
CVE-2020-5412 is a medium-severity server-side request forgery vulnerability in Spring Cloud Netflix, published on 7 Aug 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
Which versions are affected by CVE-2020-5412?
4 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-netflix. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-netflix Maven | From 2.1.0 | 2.1.6 |
org.springframework.cloud:spring-cloud-netflix Maven | From 2.1.0 | 2.1.6 |
org.springframework.cloud:spring-cloud-netflix Maven | From 2.2.0 | 2.2.4 |
org.springframework.cloud:spring-cloud-netflix Maven | From 2.2.0 | 2.2.4 |
Products include Vmware Spring Cloud Netflix.
How do I fix CVE-2020-5412?
Upgrade org.springframework.cloud:spring-cloud-netflix to a fixed version for your release line: 2.1.6 or 2.2.4.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-5412 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-5412 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Spring Cloud Netflix
Sources
Also known as GHSA-qgcg-p3v2-9h4p.