Server Side Request Forgery Via DNS Rebinding in appsmithorg/appsmith

Valid

Reported on

Oct 13th 2022


Description

Appsmith below v1.8.1 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via DNS Rebinding technique to hit AWS internal metadata endpoint and for retrieving data.

Proof of Concept

https://drive.google.com/file/d/1rXnHmhCpo59NjMZJGqKUuOZaQzkXjw6p/view?usp=sharing

Impact

Extract Cloud metadata's like AWS,GCP,Digitalocean etc. and hit internal resources and read access internally hosted web services.

We are processing your report and will contact the appsmithorg/appsmith team within 24 hours. 2 months ago
We have contacted a member of the appsmithorg/appsmith team and are waiting to hear back a month ago
We have sent a follow up to the appsmithorg/appsmith team. We will try again in 7 days. a month ago
We have sent a second follow up to the appsmithorg/appsmith team. We will try again in 10 days. a month ago
We have sent a third and final follow up to the appsmithorg/appsmith team. This report is now considered stale. a month ago
appsmithorg/appsmith maintainer validated this vulnerability 8 days ago

This vulnerability is fixed in Appsmith versions greater than v1.8.1

Basavaraj Banakar has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
appsmithorg/appsmith maintainer marked this as fixed in 1.8.2 with commit 769719 8 days ago
The fix bounty has been dropped
This vulnerability has been assigned a CVE
appsmithorg/appsmith maintainer published this vulnerability 8 days ago
Basavaraj
8 days ago

Researcher


Hi team,

Thanks for assigning cve, Please let me know when it will reflect on cve mitre

Thanks & regards, Basavaraj

Basavaraj
7 days ago

Researcher


Hi team,

Please hide the proof of concept link from the report!

Thanks

Basavaraj
7 days ago

Researcher


And Please add this writeup link in references!

https://basu-banakar.medium.com/ssrf-via-dns-rebinding-cve-2022-4096-b7bf75928bb2

Thanks!

to join this conversation