CVE-2024-43379 TruffleHog has a Blind SSRF in some Detectors

What is CVE-2024-43379?

CVE-2024-43379 is a low-severity vulnerability in trufflesecurity trufflehog, published on 19 Aug 2024.

Official description

TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, the target endpoint must be an unauthenticated GET endpoint that produces side effects. The victim must scan the maliciously crafted data and have such an endpoint targeted for the exploit to succeed. The vulnerability has been resolved in TruffleHog v3.81.9 and later versions.

Weakness: CWE-918

Which versions are affected by CVE-2024-43379?

4 open source packages ship an affected version, including github.com/trufflesecurity/trufflehog/v3 and github.com/trufflesecurity/trufflehog. It affects 1 product.

Products include Trufflesecurity Trufflehog.

How do I fix CVE-2024-43379?

Upgrade github.com/trufflesecurity/trufflehog/v3 to 3.81.9 or later.

Is CVE-2024-43379 being exploited?

There is no known exploitation of CVE-2024-43379 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3r74-v83p-f4f4, GO-2024-3076.