CVE-2023-40017: Geonode Server Side Request Forgery vulnerability
Summary A server side request forgery vuln was found within geonode when testing on a bug bounty program. Server side request forgery allows a user to request information on the internal service/services.
Details The endpoint /proxy/?url= does not properly protect against SSRF. when using the following format you can request internal hosts and display data. /proxy/?url=http://169.254.169.254\@whitelistedIPhere. This will state wether the AWS internal IP is alive. If you get a 404, the host is alive. A non alive host will not display a response. To display metadata, use a hashfrag on the url /proxy/?url=http://169.254.169.254\@#whitelisteddomain.com or try /proxy/?url=http://169.254.169.254\@%23whitelisteddomain.com
Impact Port scan internal hosts, and request information from internal hosts.
Other sources
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint /proxy/?url= does not properly protect against server-side request forgery. This allows an attacker to port scan internal hosts and request information from internal hosts. A patch is available at commit a9eebae80cb362009660a1fd49e105e7cdb499b9.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-40017?
CVE-2023-40017 is a vulnerability in GeoNode that allows server-side request forgery, potentially enabling an attacker to port scan internal hosts and request internal resources.
What is GeoNode?
GeoNode is an open source platform for creating, sharing, and collaborating on geospatial data.
What versions of GeoNode are affected by CVE-2023-40017?
Versions 3.2.0 through 4.1.2 of GeoNode are affected by CVE-2023-40017.
How severe is CVE-2023-40017?
CVE-2023-40017 has a severity rating of high (7.5).
How can I fix CVE-2023-40017?
To fix CVE-2023-40017, it is recommended to update GeoNode to a version that includes the fix or apply the necessary patch provided by the product vendor.