Server-Side Request Forgery
What is Server-Side Request Forgery?
Server-Side Request Forgery (SSRF) occurs when a threat actor tricks a server into making requests to unintended destinations. These requests often target internal systems that are not directly accessible from the internet, potentially exposing sensitive services or data.
Where was the SSRF Vulnerability Found?
This SSRF issue was identified in the endpoint responsible for proxying external tile services. Specifically, the endpoint accepted a URL parameter (REQUEST_URL) that was passed directly into the server-side application. This caused the application to make requests to attacker-controlled locations and return the associated responses.
Further details can be found under CVE-2022-42183 in the relevant security advisory.
Path Traversal Sequence Leading to Authentication Bypass
What is Path Traversal?
Path Traversal vulnerabilities enable unauthorised access to files and directories by manipulating file paths. These attacks often bypass intended access controls and allow retrieval of sensitive information.
Where was the Vulnerability Found?
Multiple endpoints were discovered to accept arbitrary URLs through a URL parameter. Rather than targeting static files, this attack used a traversal sequence to redirect requests to SOAP and REST API endpoints that were otherwise protected by Basic Authentication. By doing so, the attacker could bypass authentication and access sensitive API functionality.
This issue is documented under CVE-2022-42182, as noted in the vendor’s security advisory.
Vulnerability Disclosure Timeline
- 19 August 2022 – Vendor acknowledged the vulnerabilities and confirmed they would be addressed in the next release.
- 8 October 2022 – Version 2022.1.0 S06 released, containing the fixes.
- 18 October 2022 – CVE identifiers CVE-2022-42182 and CVE-2022-42183 reserved.
- 16 November 2022 – Public blog post published summarising the findings.
