CVE-2023-41327 Controlled SSRF through URL in the WireMock
Attackers can bypass proxy restrictions in WireMock webhooks to send requests to internal services, potentially accessing sensitive data or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-41327?
CVE-2023-41327 is a medium-severity server-side request forgery vulnerability in wiremock, published on 6 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
WireMock is a tool for mocking HTTP services. WireMock can be configured to only permit proxying (and therefore recording) to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first.
Until WireMock Webhooks Extension 3.0.0-beta-15, the filtering of target addresses from the proxy mode DID NOT work for Webhooks, so the users were potentially vulnerable regardless of the `limitProxyTargets` settings. Via the WireMock webhooks configuration, POST requests from a webhook might be forwarded to an arbitrary service reachable from WireMock’s instance. For example, If someone is running the WireMock docker Container inside a private cluster, they can trigger internal POST requests against unsecured APIs or even against secure ones by passing a token, discovered using another exploit, via authentication headers. This issue has been addressed in versions 2.35.1 and 3.0.3 of wiremock. Wiremock studio has been discontinued and will not see a fix. Users unable to upgrade should use external firewall rules to define the list of permitted destinations.
Weakness: CWE-918
Which versions are affected by CVE-2023-41327?
5 open source packages ship an affected version, including org.wiremock:wiremock-webhooks-extension and wiremock. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.wiremock:wiremock-webhooks-extension Maven | From 2.0.0 | 2.35.1 |
org.wiremock:wiremock-webhooks-extension Maven | From 2.0.0 | 2.35.1 |
org.wiremock:wiremock-webhooks-extension Maven | From 3.0.0 | 3.0.3 |
org.wiremock:wiremock-webhooks-extension Maven | From 3.0.0 | 3.0.3 |
wiremock Bitnami | From 2.0.0 | 2.35.1, 3.0.3 |
Products include Wiremock Studio, Wiremock Wiremock.
How do I fix CVE-2023-41327?
Upgrade org.wiremock:wiremock-webhooks-extension to a fixed version for your release line: 2.35.1 or 3.0.3.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-41327 being exploited?
There is no known exploitation of CVE-2023-41327 in the wild and no public exploit code.
Other vulnerabilities in wiremock
Sources
Also known as BIT-wiremock-2023-41327, GHSA-hq8w-9w8w-pmx7.