Server Side Request Forgery Via DNS Rebinding in appsmithorg/appsmith

Valid

Reported on

Oct 13th 2022

Description

Appsmith below v1.8.1 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via DNS Rebinding technique to hit AWS internal metadata endpoint and for retrieving data.

Proof of Concept

https://drive.google.com/file/d/1rXnHmhCpo59NjMZJGqKUuOZaQzkXjw6p/view?usp=sharing

Impact

Extract Cloud metadata's like AWS,GCP,Digitalocean etc. and hit internal resources and read access internally hosted web services.

We are processing your report and will contact the appsmithorg/appsmith team within 24 hours. a year ago
We have contacted a member of the appsmithorg/appsmith team and are waiting to hear back a year ago
We have sent a follow up to the appsmithorg/appsmith team. We will try again in 7 days. a year ago
We have sent a second follow up to the appsmithorg/appsmith team. We will try again in 10 days. a year ago
We have sent a third and final follow up to the appsmithorg/appsmith team. This report is now considered stale. a year ago
A appsmithorg/appsmith maintainer validated this vulnerability a year ago

This vulnerability is fixed in Appsmith versions greater than v1.8.1

Basavaraj Banakar has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
A appsmithorg/appsmith maintainer marked this as fixed in 1.8.2 with commit 769719 a year ago
The fix bounty has been dropped
This vulnerability has been assigned a CVE
A appsmithorg/appsmith maintainer published this vulnerability a year ago
Basavaraj
a year ago

Researcher

Hi team,

Thanks for assigning cve, Please let me know when it will reflect on cve mitre

Thanks & regards, Basavaraj

Basavaraj
a year ago

Researcher

Hi team,

Please hide the proof of concept link from the report!

Thanks

Basavaraj
a year ago

Researcher

And Please add this writeup link in references!

https://basu-banakar.medium.com/ssrf-via-dns-rebinding-cve-2022-4096-b7bf75928bb2

Thanks!

to join this conversation