CVE-2024-41664: Blind SSRF via Canarytoken Webhook
Canarytokens help track activity and actions on a network. Prior to sha-8ea5315, Canarytokens.org was vulnerable to a blind SSRF in the Webhook alert feature. When a Canarytoken is created, users choose to receive alerts either via email or via a webhook. If a webhook is supplied when a Canarytoken is first created, the site will make a test request to the supplied URL to ensure it accepts alert notification HTTP requests. No safety checks were performed on the URL, leading to a Server-Side Request Forgery vulnerability. The SSRF is Blind because the content of the response is not displayed to the creating user; they are simply told whether an error occurred in making the test request. Using the Blind SSRF, it was possible to map out open ports for IPs inside the Canarytokens.org infrastructure. This issue is now patched on Canarytokens.org. Users of self-hosted Canarytokens installations can update by pulling the latest Docker image, or any Docker image after sha-097d91a.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41664?
The severity of CVE-2024-41664 is classified as high due to the potential for unauthorized access to sensitive information via a blind Server-Side Request Forgery (SSRF).
How do I fix CVE-2024-41664?
To fix CVE-2024-41664, update your Canarytokens.org deployment to versions after sha-8ea5315 for the hosted version or ensure your self-hosted version is above sha-097d91a.
Who is affected by CVE-2024-41664?
CVE-2024-41664 affects users of Canarytokens.org prior to the sha-8ea5315 version and self-hosted Canarytokens installations before the sha-097d91a version.
What does CVE-2024-41664 exploit?
CVE-2024-41664 exploits a blind SSRF vulnerability in the Webhook alert feature of Canarytokens, allowing potential attackers to access internal resources.
What are Canarytokens in relation to CVE-2024-41664?
Canarytokens are tools used to track unauthorized access or activity in a network, but due to CVE-2024-41664, their webhook alert feature has a critical security flaw.