CVE-2023-49795: GHSL-2023-182_GHSL-2023-184: Server-side request forgery (SSRF), arbitrary file write and limited file write vulnerabilities in mindsdb/mindsdb - CVE-2023-49795, CVE-2023-50731, CVE-2023-49796
Impact
The put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled URL in the source variable and uses it to create arbitrary requests on line 115, which allows Server-side request forgery (SSRF). This issue may lead to Information Disclosure. The SSRF allows for forging arbitrary network requests from the MindsDB server. It can be used to scan nodes in internal networks for open ports that may not be accessible externally, as well as scan for existing files on the internal network. It allows for retrieving files with csv, xls, xlsx, json or parquet extensions, which will be viewable via MindsDB GUI. For any other existing files, it is a blind SSRF. Patches
Use mindsdb staging branch or v23.11.4.1
References
GHSL-2023-182 SSRF prevention cheatsheet.
Other sources
MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in file.py. This can lead to limited information disclosure. Users should use MindsDB's staging branch or v23.11.4.1, which contain a fix for the issue.
— MITRE
Three vulnerabilities that can be exploited by unauthenticated users were found in MindsDB: a Server-side request forgery (SSRF) vulnerability, an arbitrary file write vulnerability and a limited file write vulnerability.
— GitHub Security Lab
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49795?
CVE-2023-49795 is classified as a high severity vulnerability due to its potential for server-side request forgery (SSRF).
How do I fix CVE-2023-49795?
To fix CVE-2023-49795, upgrade to MindsDB version 23.11.4.1 or later, which addresses the vulnerability.
What type of vulnerability is CVE-2023-49795?
CVE-2023-49795 is a server-side request forgery (SSRF) vulnerability.
Which versions of MindsDB are affected by CVE-2023-49795?
MindsDB versions prior to 23.11.4.1 are affected by CVE-2023-49795.
What actions are at risk due to CVE-2023-49795?
CVE-2023-49795 allows attackers to create arbitrary requests, which may lead to leakage of sensitive information.