CVE-2022-38580 Skipper vulnerable to SSRF via X-Skipper-Proxy
An attacker can exploit a Server-Side Request Forgery vulnerability in the Skipper HTTP proxy to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-38580?
CVE-2022-38580 is a critical server-side request forgery vulnerability in n/a, published on 24 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
Weakness: CWE-918
Which versions are affected by CVE-2022-38580?
3 open source packages ship an affected version, including github.com/zalando/skipper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zalando/skipper Go | All versions | 0.13.237 |
github.com/zalando/skipper Go | All versions | 0.13.237 |
github.com/zalando/skipper Go | All versions | 0.13.237 |
Products include Zalando Skipper.
How do I fix CVE-2022-38580?
Upgrade github.com/zalando/skipper to 0.13.237 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-38580 being exploited?
There is no known exploitation of CVE-2022-38580 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-f2rj-m42r-6jm2, GO-2022-1086.