CVE-2022-26945 Server-side request forgery in n/a
Attackers can bypass security controls and access internal resources via protocol switching and endless redirects in the go-getter library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-26945?
CVE-2022-26945 is a critical server-side request forgery vulnerability in n/a, published on 25 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.
Which versions are affected by CVE-2022-26945?
It affects 1 product.
Products include Hashicorp Go-Getter.
How do I fix CVE-2022-26945?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-26945 being exploited?
There is no known exploitation of CVE-2022-26945 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-3817 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches
- CVE-2022-30321 Path traversal in n/a
- CVE-2022-30322 Denial of service in n/a
- CVE-2022-30323 Denial of service in n/a
- CVE-2024-6257 HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation
Sources
Also known as DEBIAN-CVE-2022-26945, MINI-23c8-pxjj-pw9f, MINI-24fr-2cjw-rfv9, MINI-2826-f5fx-cvj4, MINI-297j-98wq-cghx, MINI-2g95-qx7v-cfm5 and 152 more.