CVE-2022-24856: Server-Side Request Forgery in FlyteConsole
FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. The patch for this issue deletes the entire corsproxy, as this is not required for console anymore. A patch is available in FlyteConsole version 0.52.0. Disable FlyteConsole availability on the internet as a workaround.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-24856?
CVE-2022-24856 is a vulnerability in FlyteConsole, where it is susceptible to server-side request forgery (SSRF) when open to the general internet.
How severe is CVE-2022-24856?
CVE-2022-24856 has a severity rating of 7.5 (critical).
What is the affected software?
The affected software is FlyteConsole prior to version 0.52.0.
How can an attacker exploit CVE-2022-24856?
An attacker can exploit CVE-2022-24856 by using a vulnerable instance to access the internal metadata server.
How can I fix CVE-2022-24856?
To fix CVE-2022-24856, upgrade FlyteConsole to version 0.52.0 or later.