Disclosure Date 2021/08/31
CVE-2021-32407
Server-Side Request Forgery (SSRF) vulnerability in Kallithea
KallitheaにおけるSSRF(サーバサイドリクエストフォージェリ)
Credit
stypr (@stereotype32)
Affected-Versions
v0.6.2 and earlier
CWE
CWE-93
Description
Server-Side Request Forgery (SSRF) vulnerability in Kallithea - v0.1 up to v0.6.2 and fixed in v0.6.3, allows a remote authenticated attacker to execute a 'git clone' with a crafted URL, which allows them to send arbitrary packets into the local network accessible from the server.
Product-URLs
https://kallithea-scm.org/
Reference
- https://kallithea-scm.org/security/20201201-stypr-2.html
- https://kallithea-scm.org/repos/kallithea/changeset/a8a51a3bdb6181e498a862f84eb2d50928330a68
