CVE-2017-18638in critical feedNuclei template
graphite.composer.views.send_email vulnerable to SSRF
Also known as GHSA-vfj6-275q-4pvm, PYSEC-2019-151
Published 7 y ago · modified 4 mo ago · JSON
Summary
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
Exploit prediction (EPSS)
15.30% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
Exploits and detections
- Nuclei template Graphite <=1.1.5 - Server-Side Request Forgery · nuclei detection template
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | graphite-web | <1.1.6 | 1.1.6 |
Classification
- Weakness
- CWE-918 Server-Side Request Forgery
References
- github.com /graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm · x_refsource_MISC, x_transferred
- github.com /graphite-project/graphite-web/issues/2008 · x_refsource_MISC, x_transferred
- blog.orange.tw /2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf · x_refsource_MISC, x_transferred
- youtube.com /watch?v=ds4Gp4xoaeA · x_refsource_MISC, x_transferred
- github.com /graphite-project/graphite-web/pull/2499 · x_refsource_MISC, x_transferred
- lists.debian.org /debian-lts-announce/2019/10/msg00030.html · mailing-list, x_refsource_MLIST, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-18638 · advisory
- github.com /graphite-project/graphite-web/commit/71726a0e41a5263f49b973a7b856505a5b931c1f · web
- github.com /graphite-project/graphite-web · package
- github.com /pypa/advisory-database/tree/main/vulns/graphite-web/PYSEC-2019-151.yaml · web
Sources
- CVE List: CVE-2017-18638
- GitHub Advisory: GHSA-vfj6-275q-4pvm
- NVD: CVE-2017-18638
- OSV: PYSEC-2019-151
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.