fermyon spin up to 2.4.2 Outbound Requests external reference

Summaryinfo

A vulnerability marked as critical has been reported in fermyon spin up to 2.4.2. Affected by this issue is some unknown functionality of the component Outbound Requests Handler. The manipulation leads to external reference. This vulnerability is documented as CVE-2024-32980. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in fermyon spin up to 2.4.2 and classified as critical. This issue affects an unknown code of the component Outbound Requests Handler. The manipulation with an unknown input leads to a external reference vulnerability. Using CWE to declare the problem leads to CWE-610. The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application's component handling the incoming request is configured with an `allow_outbound_hosts` list containing `"self"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port. Spin 2.4.3 has been released to fix this issue.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-32980 since 04/22/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 2.4.3 eliminates this vulnerability. Applying the patch b3db535c9edb72278d4db3a201f0ed214e561354 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• fermyon

Name

• spin

Version

• 2.4.0
• 2.4.1
• 2.4.2

License

• open-source

Website

• Product: https://github.com/fermyon/spin/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion