CVE-2020-9298 Server-Side Request Forgery in Spinnaker Orca
An attacker can exploit SSRF in Spinnaker template resolution to send requests on behalf of the service, potentially disclosing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-9298?
CVE-2020-9298 is a high-severity server-side request forgery vulnerability in Netflix Orca Spinnaker, published on 28 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.
Weakness: CWE-918
Which versions are affected by CVE-2020-9298?
2 open source packages ship an affected version, including com.netflix.spinnaker.orca:orca-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.netflix.spinnaker.orca:orca-core Maven | All versions | 8.7.0 |
com.netflix.spinnaker.orca:orca-core Maven | All versions | 8.7.0 |
Products include Spinnaker Orca.
How do I fix CVE-2020-9298?
Upgrade com.netflix.spinnaker.orca:orca-core to 8.7.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-9298 being exploited?
There is no known exploitation of CVE-2020-9298 in the wild and no public exploit code.
Sources
Also known as GHSA-4fcw-pq4r-f4q7.