Vulnerability · Published Aug 19, 2024 · Assigned by GitHub_M
CVE-2024-43379TruffleHog has a Blind SSRF in some Detectors
Low 3.4
In plain English
A low-severity server-side request forgery in trufflehog from trufflesecurity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, the target endpoint must be an unauthenticated GET endpoint that produces side effects. The victim must scan the maliciously crafted data and have such an endpoint targeted for the exploit to succeed. The vulnerability has been resolved in TruffleHog v3.81.9 and later versions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/trufflesecurity/trufflehog | no fix listed | GO-2024-3076 |
| Go | github.com/trufflesecurity/trufflehog/v3 | 3.81.9 | GHSA-3r74-v83p-f4f4 |
| Go | github.com/trufflesecurity/trufflehog/v3 | 3.81.9 | GO-2024-3076 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| trufflesecurity | trufflehog | < 3.81.9 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N