CVE-2024-23838: TrueLayer.Client SSRF when fetching payment or payment provider
Impact The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to information disclosure.
Patches Versions of TrueLayer.Client v1.6.0 and later are not affected.
Workarounds The issue can be mitigated by having strict egress rules limiting the destinations to which requests can be made, and applying strict validation to any user input passed to the TrueLayer.Client library.
Other sources
TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to information disclosure. The issue can be mitigated by having strict egress rules limiting the destinations to which requests can be made, and applying strict validation to any user input passed to the truelayer-dotnet library. Versions of TrueLayer.Client v1.6.0 and later are not affected.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/TrueLayer.Clientto a version that resolves this vulnerability.Fixed in 1.6.0 - Upgrade
Upgrade
TrueLayer.Clientto a version that resolves this vulnerability.Fixed in v1.6.0 - Configuration
Mitigate SSRF by applying strict validation to any user input that is passed into the TrueLayer.Client library / `truelayer-dotnet` library, especially anything that could influence or supply destination URLs.
TrueLayer.Client / truelayer-dotnet SDK usage User input validation (for URLs/destinations passed into TrueLayer.Client/`truelayer-dotnet` library) = Strict - Compensating control
Mitigate SSRF by enforcing strict egress network rules that limit outbound destinations to only the required networks/resources for requests made by TrueLayer clients.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23838?
CVE-2024-23838 is considered a medium severity vulnerability due to the potential for unauthorized control over the destination URL in HttpClient requests.
How do I fix CVE-2024-23838?
To fix CVE-2024-23838, upgrade the TrueLayer.Client SDK to version 1.6.0 or higher.
What types of applications are affected by CVE-2024-23838?
Applications using the TrueLayer.Client SDK up to version 1.6.0 are affected by CVE-2024-23838.
What risks does CVE-2024-23838 pose to my application?
CVE-2024-23838 poses risks by allowing malicious actors to redirect API requests to unintended resources, potentially leading to data exfiltration.
Is my software vulnerable if I have a version higher than 1.6.0 of the TrueLayer.Client?
No, if you are using TrueLayer.Client version 1.6.0 or higher, your software is not vulnerable to CVE-2024-23838.