CVE-2023-25753

CWE-918 — Server-Side Request Forgery (SSRF)4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.7%
top 26.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache ShenyuApache Shenyu
Timeline
PublishedOct 19

Description

There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter. Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing. This issue affects Apa…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5

Affected Packages4 packages

▶NVDapache/shenyu2.5.1

🔴Vulnerability Details

3
GHSA
Apache Shenyu Server Side Request Forgery vulnerability↗2023-10-19
▶
CVEList
Server-Side Request Forgery in Apache ShenYu↗2023-10-19
▶
OSV
Apache Shenyu Server Side Request Forgery vulnerability↗2023-10-19
▶