CVE-2024-32980 Spin contains a potential network sandbox escape for specifically configured Spin applications

What is CVE-2024-32980?

CVE-2024-32980 is a critical server-side request forgery vulnerability in fermyon spin, published on 8 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application's component handling the incoming request is configured with an `allow_outbound_hosts` list containing `"self"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port. Spin 2.4.3 has been released to fix this issue.

Weakness: CWE-610

Which versions are affected by CVE-2024-32980?

2 open source packages ship an affected version, including spin-sdk.

How do I fix CVE-2024-32980?

Upgrade spin-sdk to 2.4.3 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-32980 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-32980 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f3h7-gpjj-wcvh.