CVE-2022-24856 Server-Side Request Forgery in FlyteConsole
Attackers can exploit SSRF in FlyteConsole to access internal metadata servers or unauthenticated URLs when the console is exposed to the internet.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-24856?
CVE-2022-24856 is a critical server-side request forgery vulnerability in flyteorg flyteconsole, published on 17 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. The patch for this issue deletes the entire `cors_proxy`, as this is not required for console anymore. A patch is available in FlyteConsole version 0.52.0. Disable FlyteConsole availability on the internet as a workaround.
Weakness: CWE-918
Which versions are affected by CVE-2022-24856?
It affects 1 product.
Products include Flyte Flyte Console.
How do I fix CVE-2022-24856?
No fix has been published for CVE-2022-24856 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-24856 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24856 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-www6-hf2v-v9m9.