WireMock up to 2.35.0/3.0.2 Webhooks Extension server-side request forgery

Summaryinfo

A vulnerability classified as critical has been found in WireMock up to 2.35.0/3.0.2. This vulnerability affects unknown code of the component Webhooks Extension. This manipulation causes server-side request forgery. This vulnerability is tracked as CVE-2023-41327. The attack is only possible within the local network. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in WireMock up to 2.35.0/3.0.2. Affected by this vulnerability is some unknown processing of the component Webhooks Extension. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

WireMock is a tool for mocking HTTP services. WireMock can be configured to only permit proxying (and therefore recording) to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first. Until WireMock Webhooks Extension 3.0.0-beta-15, the filtering of target addresses from the proxy mode DID NOT work for Webhooks, so the users were potentially vulnerable regardless of the `limitProxyTargets` settings. Via the WireMock webhooks configuration, POST requests from a webhook might be forwarded to an arbitrary service reachable from WireMock’s instance. For example, If someone is running the WireMock docker Container inside a private cluster, they can trigger internal POST requests against unsecured APIs or even against secure ones by passing a token, discovered using another exploit, via authentication headers. This issue has been addressed in versions 2.35.1 and 3.0.3 of wiremock. Wiremock studio has been discontinued and will not see a fix. Users unable to upgrade should use external firewall rules to define the list of permitted destinations.

The weakness was disclosed 09/07/2023 by Firewall as GHSA-hq8w-9w8w-pmx7. The advisory is shared at github.com. This vulnerability is known as CVE-2023-41327 since 08/28/2023. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

Upgrading to version 2.35.1, 3.0.0-beta-15 or 3.0.3 eliminates this vulnerability. The upgrade is hosted for download at github.com.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• WireMock

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35.0
• 3.0.0
• 3.0.1
• 3.0.2

Website

• Product: https://github.com/wiremock/wiremock/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion