CVE-2022-24980 SSRF in Kitodo.Presentation
Unauthenticated attackers can exploit a missing access check in the Kitodo.Presentation TYPO3 extension to perform Server-Side Request Forgery and read internal files or webpages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24980?
CVE-2022-24980 is a high-severity server-side request forgery vulnerability in n/a, published on 19 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to view the content of any file or webpage the webserver has access to.
Weakness: CWE-918
Which versions are affected by CVE-2022-24980?
6 open source packages ship an affected version, including kitodo/presentation. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kitodo/presentation Packagist | All versions | 2.3.2 |
kitodo/presentation Packagist | All versions | 2.3.2 |
kitodo/presentation Packagist | From 3.0.0 | 3.2.3 |
kitodo/presentation Packagist | From 3.0.0 | 3.2.3 |
kitodo/presentation Packagist | From 3.3.0 | 3.3.4 |
kitodo/presentation Packagist | From 3.3.0 | 3.3.4 |
Products include Kitodo Kitodo.presentation.
How do I fix CVE-2022-24980?
Upgrade kitodo/presentation to a fixed version for your release line: 2.3.2, 3.2.3 or 3.3.4.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-24980 being exploited?
There is no known exploitation of CVE-2022-24980 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-x832-r2rj-4g5p.