CVE-2021-33516 Server-side request forgery in n/a
Remote attackers can exploit DNS rebinding in GUPnP to trick browsers into accessing local UPnP services, enabling data exfiltration or modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-33516?
CVE-2021-33516 is a high-severity server-side request forgery vulnerability in n/a, published on 24 May 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.
Which versions are affected by CVE-2021-33516?
It affects 1 product.
Linux distribution packages (40)
gupnp AlmaLinux:8 | All versions | 1.0.6-2.el8_4 |
gupnp-devel AlmaLinux:8 | All versions | 1.0.6-2.el8_4 |
gupnp Red Hat:enterprise_linux:7::client | All versions | 0:1.0.2-6.el7_9 |
gupnp-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:1.0.2-6.el7_9 |
gupnp-devel Red Hat:enterprise_linux:7::client | All versions | 0:1.0.2-6.el7_9 |
gupnp-docs Red Hat:enterprise_linux:7::client | All versions | 0:1.0.2-6.el7_9 |
gupnp-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:1.0.2-6.el7_9 |
gupnp-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:1.0.2-6.el7_9 |
gupnp-docs Red Hat:enterprise_linux:7::computenode | All versions | 0:1.0.2-6.el7_9 |
gupnp Red Hat:enterprise_linux:7::server | All versions | 0:1.0.2-6.el7_9 |
gupnp-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1.0.2-6.el7_9 |
gupnp-devel Red Hat:enterprise_linux:7::server | All versions | 0:1.0.2-6.el7_9 |
gupnp-docs Red Hat:enterprise_linux:7::server | All versions | 0:1.0.2-6.el7_9 |
gupnp Red Hat:enterprise_linux:7::workstation | All versions | 0:1.0.2-6.el7_9 |
gupnp-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:1.0.2-6.el7_9 |
gupnp-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:1.0.2-6.el7_9 |
gupnp-docs Red Hat:enterprise_linux:7::workstation | All versions | 0:1.0.2-6.el7_9 |
gupnp Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-2.el8_4 |
gupnp-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-2.el8_4 |
gupnp-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-2.el8_4 |
gupnp-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.6-2.el8_4 |
gupnp-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.6-2.el8_4 |
gupnp-devel Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.6-2.el8_4 |
gupnp Red Hat:rhel_eus:8.1::appstream | All versions | 0:1.0.3-3.el8_1 |
gupnp-debuginfo Red Hat:rhel_eus:8.1::appstream | All versions | 0:1.0.3-3.el8_1 |
gupnp-debugsource Red Hat:rhel_eus:8.1::appstream | All versions | 0:1.0.3-3.el8_1 |
gupnp-debuginfo Red Hat:rhel_eus:8.1::crb | All versions | 0:1.0.3-3.el8_1 |
gupnp-debugsource Red Hat:rhel_eus:8.1::crb | All versions | 0:1.0.3-3.el8_1 |
gupnp-devel Red Hat:rhel_eus:8.1::crb | All versions | 0:1.0.3-3.el8_1 |
gupnp Red Hat:rhel_eus:8.2::appstream | All versions | 0:1.0.3-3.el8_2 |
gupnp-debuginfo Red Hat:rhel_eus:8.2::appstream | All versions | 0:1.0.3-3.el8_2 |
gupnp-debugsource Red Hat:rhel_eus:8.2::appstream | All versions | 0:1.0.3-3.el8_2 |
gupnp-debuginfo Red Hat:rhel_eus:8.2::crb | All versions | 0:1.0.3-3.el8_2 |
gupnp-debugsource Red Hat:rhel_eus:8.2::crb | All versions | 0:1.0.3-3.el8_2 |
gupnp-devel Red Hat:rhel_eus:8.2::crb | All versions | 0:1.0.3-3.el8_2 |
gupnp Rocky Linux:8 | All versions | 0:1.0.6-2.el8_4 |
gupnp SUSE:Linux Enterprise Module for Desktop Applications 15 SP2 | All versions | 1.2.2-3.3.1 |
gupnp SUSE:Linux Enterprise Module for Desktop Applications 15 SP3 | All versions | 1.2.2-3.3.1 |
gupnp SUSE:Linux Enterprise Module for Package Hub 15 SP2 | All versions | 1.2.2-3.3.1 |
gupnp SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 1.2.2-3.3.1 |
Products include Gnome Gupnp.
How do I fix CVE-2021-33516?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-33516 being exploited?
There is no known exploitation of CVE-2021-33516 in the wild and no public exploit code.
Sources
Also known as ALSA-2021:2363, CLSA-2026-1791546292, DEBIAN-CVE-2021-33516, GHSA-mqgp-2h56-fx4q, MGASA-2021-0321, OESA-2021-1272 and 11 more.