# CVE-2024-43371: Potential access to sensitive URLs via CKAN extensions (SSRF) > Attackers can exploit CKAN plugins to perform Server-Side Request Forgery, accessing sensitive internal URLs without proper validation. - **Severity:** Medium 4.5 (`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N`) - **Exploited in the wild:** Not known - **Login needed:** An administrator - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 21 Aug 2024 - **Updated:** 22 Aug 2024 - **Also known as:** GHSA-g9ph-j5vj-f8wm, PYSEC-2026-1252 ## What is CVE-2024-43371? CVE-2024-43371 is a medium-severity server-side request forgery vulnerability in ckan, published on 21 Aug 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link. ### Official description CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming contents or saving a local copy). All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it (known as a Server Side Request Forgery). Users wanting to protect against these kinds of attacks can use one or a combination of the following approaches: (1) Use a separate HTTP proxy like Squid that can be used to allow / disallow IPs, domains etc as needed, and make CKAN extensions aware of this setting via the ckan.download_proxy config option. (2) Implement custom firewall rules to prevent access to restricted resources. (3) Use custom validators on the resource url field to block/allow certain domains or IPs. All latest versions of the plugins listed above support the ckan.download_proxy settings. Support for this setting in the Resource Proxy plugin was included in CKAN 2.10.5 and 2.11.0. Weakness: CWE-918 (Server-Side Request Forgery) ## Which versions are affected by CVE-2024-43371? 3 open source packages ship an affected version, including ckan. It affects 1 product. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `ckan` | PyPI | All versions | 2.10.5 | | `ckan` | PyPI | All versions | 2.10.5 | | `ckan` | PyPI | All versions | 2.10.5 | Products: Okfn Ckan. ## How do I fix CVE-2024-43371? Upgrade ckan to 2.10.5 or later. ## Is CVE-2024-43371 being exploited? There is no known exploitation of CVE-2024-43371 in the wild and no public exploit code. ## Other vulnerabilities in ckan - [CVE-2023-32321](https://insights.sbomify.com/CVE-2023-32321/): CKAN remote code execution and private information access via crafted resource ids (critical 9.8) - [CVE-2023-32696](https://insights.sbomify.com/CVE-2023-32696/): Excessive permissions for ckan user (high 8.8) - [CVE-2022-43685](https://insights.sbomify.com/CVE-2022-43685/): CKAN contains Improper Authentication leading to account takeover (high 8.8) - [CVE-2023-22746](https://insights.sbomify.com/CVE-2023-22746/): CKAN is vulnerable to session secret shared across instances using Docker images (high 8.6) - [CVE-2026-42031](https://insights.sbomify.com/CVE-2026-42031/): CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` (high 8.3) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2024-43371 and fix it if it is affected. What it is: CVE-2024-43371 is a medium-severity server-side request forgery vulnerability in ckan, published on 21 Aug 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link. Exploitation: There is no known exploitation of CVE-2024-43371 in the wild and no public exploit code. Affected packages and fixed versions: - ckan (PyPI): affected all versions; fixed in 2.10.5 - ckan (PyPI): affected all versions; fixed in 2.10.5 - ckan (PyPI): affected all versions; fixed in 2.10.5 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2024-43371/ (Markdown: https://insights.sbomify.com/CVE-2024-43371/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2024-43371 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43371 - OSV: https://osv.dev/vulnerability/CVE-2024-43371 --- From sbomify Insights: https://insights.sbomify.com/CVE-2024-43371/ Summaries are generated and may contain mistakes; the official description above is the record.