{"answers":{"affected":"3 open source packages ship an affected version, including ckan. It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-43371 in the wild and no public exploit code.","fix":"Upgrade ckan to 2.10.5 or later.","what":"CVE-2024-43371 is a medium-severity server-side request forgery vulnerability in ckan, published on 21 Aug 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2024-43371 and fix it if it is affected.\n\nWhat it is: CVE-2024-43371 is a medium-severity server-side request forgery vulnerability in ckan, published on 21 Aug 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2024-43371 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- ckan (PyPI): affected all versions; fixed in 2.10.5\n- ckan (PyPI): affected all versions; fixed in 2.10.5\n- ckan (PyPI): affected all versions; fixed in 2.10.5\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-43371/ (Markdown: https://insights.sbomify.com/CVE-2024-43371/index.md)","id":"CVE-2024-43371","markdown":"https://insights.sbomify.com/CVE-2024-43371/index.md","name":"CVE-2024-43371","record":{"aliases":["GHSA-g9ph-j5vj-f8wm","PYSEC-2026-1252"],"analysis":{"component_type":"web_application","fix_type":"configuration_change","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"CKAN data portal","requires_auth":"high_privilege","summary":"Attackers can exploit CKAN plugins to perform Server-Side Request Forgery, accessing sensitive internal URLs without proper validation.","user_interaction":"required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"ckan","vendor":"okfn"}],"cvss":{"score":4.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"description":"CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming contents or saving a local copy). All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it (known as a Server Side Request Forgery). Users wanting to protect against these kinds of attacks can use one or a combination of the following approaches: (1) Use a separate HTTP proxy like Squid that can be used to allow / disallow IPs, domains etc as needed, and make CKAN extensions aware of this setting via the ckan.download_proxy config option. (2) Implement custom firewall rules to prevent access to restricted resources. (3) Use custom validators on the resource url field to block/allow certain domains or IPs. All latest versions of the plugins listed above support the ckan.download_proxy settings. Support for this setting in the Resource Proxy plugin was included in CKAN 2.10.5 and 2.11.0.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Potential access to sensitive URLs via CKAN extensions (SSRF)","id":"CVE-2024-43371","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"ssrf","year":"2024"},"n_packages":3,"n_references":1,"next":{"headline":"webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle","id":"CVE-2024-43373"},"packages":[{"ecosystem":"PyPI","fixed":["2.10.5"],"introduced":["0"],"last_affected":[],"package":"ckan","purl":null,"source":"GHSA-g9ph-j5vj-f8wm"},{"ecosystem":"PyPI","fixed":["2.10.5"],"introduced":["0"],"last_affected":[],"package":"ckan","purl":"pkg:pypi/ckan","source":"GHSA-g9ph-j5vj-f8wm"},{"ecosystem":"PyPI","fixed":["2.10.5"],"introduced":["0"],"last_affected":[],"package":"ckan","purl":"pkg:pypi/ckan","source":"PYSEC-2026-1252"}],"prev":{"headline":"gettext.js vulnerable to cross-site scripting (XSS)","id":"CVE-2024-43370"},"products":["ckan"],"published":"2024-08-21","related":[{"cvss_score":9.8,"headline":"CKAN remote code execution and private information access via crafted resource ids","id":"CVE-2023-32321","kev_date_added":null,"published":"2023-05-26"},{"cvss_score":8.8,"headline":"Excessive permissions for ckan user","id":"CVE-2023-32696","kev_date_added":null,"published":"2023-05-30"},{"cvss_score":8.8,"headline":"CKAN contains Improper Authentication leading to account takeover","id":"CVE-2022-43685","kev_date_added":null,"published":"2022-11-22"},{"cvss_score":8.6,"headline":"CKAN is vulnerable to session secret shared across instances using Docker images","id":"CVE-2023-22746","kev_date_added":null,"published":"2023-02-03"},{"cvss_score":8.3,"headline":"CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`","id":"CVE-2026-42031","kev_date_added":null,"published":"2026-05-13"},{"cvss_score":6.8,"headline":"CKAN has a Cross-site Scripting vector in the Datatables view plugin","id":"CVE-2024-41675","kev_date_added":null,"published":"2024-08-21"},{"cvss_score":6.7,"headline":"CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`","id":"CVE-2026-42032","kev_date_added":null,"published":"2026-05-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-22","vendors":["ckan"]},"summary":"Attackers can exploit CKAN plugins to perform Server-Side Request Forgery, accessing sensitive internal URLs without proper validation.","url":"https://insights.sbomify.com/CVE-2024-43371/"}