GHSA-CQH9-JFQR-H9JJ高危已审查已撤回

Withdrawn Advisory: Weights and Biases (wandb) has a Server-Side Request Forgery (SSRF) vulnerability

OSV 1.4.0 · github-reviewed · 修改于 2024-05-21 04:20

发布时间

2024-05-16 17:33

GitHub 审查时间

2024-05-17 01:46

NVD 发布时间

2024-05-16 17:15

源文件

advisories/github-reviewed/2024/05/GHSA-cqh9-jfqr-h9jj/GHSA-cqh9-jfqr-h9jj.json

该公告已于 2024-05-21 04:20 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Withdrawn Advisory

This advisory has been withdrawn because the underlying issue existed in Weights and Biases's backend server code, not the software development kit included in the wandb PyPI package, as originally reported. This link is maintained to preserve external references.

Original Description

A Server-Side Request Forgery (SSRF) vulnerability exists in the wandb/wandb repository due to improper handling of HTTP 302 redirects. This issue allows team members with access to the 'User settings -> Webhooks' function to exploit this vulnerability to access internal HTTP(s) servers. In severe cases, such as on AWS instances, this could potentially be abused to achieve remote code execution on the victim's machine. The vulnerability is present in the latest version of the repository.

受影响的软件包

PyPI

wandb

ECOSYSTEM

标识信息

别名 / CVE

CVE-2024-4642

CWE

CWE-918

软件生态

PyPI

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-cqh9-jfqr-h9jj",
  "aliases": [
    "CVE-2024-4642"
  ],
  "details": "## Withdrawn Advisory\nThis advisory has been withdrawn because the underlying issue existed in Weights and Biases's backend server code, not the software development kit included in the `wandb` PyPI package, as originally reported. This link is maintained to preserve external references.\n\n## Original Description\nA Server-Side Request Forgery (SSRF) vulnerability exists in the wandb/wandb repository due to improper handling of HTTP 302 redirects. This issue allows team members with access to the 'User settings -> Webhooks' function to exploit this vulnerability to access internal HTTP(s) servers. In severe cases, such as on AWS instances, this could potentially be abused to achieve remote code execution on the victim's machine. The vulnerability is present in the latest version of the repository.",
  "summary": "Withdrawn Advisory: Weights and Biases (wandb) has a Server-Side Request Forgery (SSRF) vulnerability",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.17.0"
            }
          ]
        }
      ],
      "package": {
        "name": "wandb",
        "ecosystem": "PyPI"
      }
    }
  ],
  "modified": "2024-05-20T20:20:22Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
    }
  ],
  "published": "2024-05-16T09:33:09Z",
  "withdrawn": "2024-05-20T20:20:22Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4642",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/wandb/wandb",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/wandb/wandb/blob/main/wandb/sdk/lib/import_hooks.py#L1",
      "type": "WEB"
    },
    {
      "url": "https://huntr.com/bounties/055eb540-57f8-46d6-b858-3a9e22d347d9",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2024-05-16T09:15:17Z",
    "github_reviewed_at": "2024-05-16T17:46:18Z"
  }
}