Red Hat OpenShift Container Platform 4 internet server-side request forgery

Summaryinfo

A vulnerability marked as critical has been reported in Red Hat OpenShift Container Platform 4. This vulnerability affects unknown code of the file /api/dev-console/proxy/internet. This manipulation causes server-side request forgery. This vulnerability appears as CVE-2024-6538. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in Red Hat OpenShift Container Platform 4. Affected by this vulnerability is an unknown code of the file /api/dev-console/proxy/internet. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality. The summary by CVE is:

A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system. The /api/dev-console/proxy/internet endpoint on the OpenShift Console allows authenticated users to have the console's pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint. While the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster.

It is possible to read the advisory at access.redhat.com. This vulnerability is known as CVE-2024-6538 since 07/05/2024. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 11/07/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-3382). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• Red Hat

Name

• OpenShift Container Platform

Version

• 4

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion