CVE-2024-43371 Potential access to sensitive URLs via CKAN extensions (SSRF)
Attackers can exploit CKAN plugins to perform Server-Side Request Forgery, accessing sensitive internal URLs without proper validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-43371?
CVE-2024-43371 is a medium-severity server-side request forgery vulnerability in ckan, published on 21 Aug 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming contents or saving a local copy). All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it (known as a Server Side Request Forgery). Users wanting to protect against these kinds of attacks can use one or a combination of the following approaches: (1) Use a separate HTTP proxy like Squid that can be used to allow / disallow IPs, domains etc as needed, and make CKAN extensions aware of this setting via the ckan.download_proxy config option. (2) Implement custom firewall rules to prevent access to restricted resources. (3) Use custom validators on the resource url field to block/allow certain domains or IPs. All latest versions of the plugins listed above support the ckan.download_proxy settings. Support for this setting in the Resource Proxy plugin was included in CKAN 2.10.5 and 2.11.0.
Weakness: CWE-918
Which versions are affected by CVE-2024-43371?
3 open source packages ship an affected version, including ckan. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ckan PyPI | All versions | 2.10.5 |
ckan PyPI | All versions | 2.10.5 |
ckan PyPI | All versions | 2.10.5 |
Products include Okfn Ckan.
How do I fix CVE-2024-43371?
Upgrade ckan to 2.10.5 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-43371 being exploited?
There is no known exploitation of CVE-2024-43371 in the wild and no public exploit code.
Other vulnerabilities in ckan
- CVE-2023-32321 CKAN remote code execution and private information access via crafted resource ids
- CVE-2023-32696 Excessive permissions for ckan user
- CVE-2022-43685 CKAN contains Improper Authentication leading to account takeover
- CVE-2023-22746 CKAN is vulnerable to session secret shared across instances using Docker images
- CVE-2026-42031 CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
Sources
Also known as GHSA-g9ph-j5vj-f8wm, PYSEC-2026-1252.