CVE-2023-24060 Server-side request forgery in n/a
Authenticated users can exploit SSRF in Haven's RSS feed functionality to access internal resources or the server itself.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-24060?
CVE-2023-24060 is a medium-severity server-side request forgery vulnerability in n/a, published on 27 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (or even the hostname of the Haven server itself). NOTE: this product has significant usage but does not have numbered releases; ordinary end users may typically use the master branch.
Weakness: CWE-918
Which versions are affected by CVE-2023-24060?
It affects 1 product.
Products include Havenweb Haven.
How do I fix CVE-2023-24060?
No fix has been published for CVE-2023-24060 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-24060 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-24060 exists.
Sources
Also known as GHSA-jmj5-q6wr-x9v2.