Listen to this Post
The CVE-2024-23325 vulnerability exploits the FetchUrlReader component in Backstage, which handles URL fetching for the catalog and plugins. This component uses a configured allowlist (backend.reading.allow) to restrict requests to trusted hosts. However, when fetching from an allowed host, if that host responds with an HTTP redirect (e.g., 301 or 302), FetchUrlReader automatically follows the redirect without validating the new URL against the allowlist. An attacker controlling a host on the allowlist can set up a malicious endpoint that redirects to internal URLs, such as cloud metadata services (e.g., http://169.254.169.254), internal APIs, or administrative interfaces. This bypasses the allowlist security control, leading to Server-Side Request Forgery (SSRF). The vulnerability does not allow attackers to inject custom headers, limiting some attack vectors. Still, it enables unauthorized access to sensitive internal resources, potentially exposing credentials, configuration data, or facilitating further network attacks. The flaw stems from insufficient redirect validation in the fetching logic, undermining the allowlist’s intended security.
Dailycve Form:
Platform: Backstage
Version: Pre-patch versions
Vulnerability: SSRF allowlist bypass
Severity: Critical
Date: 2024-01-09
Prediction: Patched 2024-01-09
What Undercode Say:
Analytics:
- Test redirect: `curl -I http://allowed-host/redirect?url=internal-service`
- Vulnerable code snippet:
async read(url) { const response = await fetch(url, { redirect: 'follow' }); }
How Exploit:
Control allowlisted host, setup redirect to internal URL, trigger FetchUrlReader request.
Protection from this CVE
Upgrade to patched versions, restrict allowlist to trusted hosts, use network controls.
Impact:
Bypass allowlist, access internal resources, information disclosure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
