Vulnerability · Published May 7, 2022 · Assigned by GitHub_M
CVE-2022-29180Charm vulnerable to server-side request forgery (SSRF)
Medium 5.9
In plain English
A medium-severity server-side request forgery in charm from charmbracelet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0.12.1). We recommend that all users running self-hosted `charm` instances update immediately. This vulnerability was found in-house and we haven't been notified of any potential exploiters. ### Additional notes * Encrypted user data uploaded to the Charm server is safe as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. * Users running the official Charm [Docker images](https://github.com/charmbracelet/charm/blob/main/docker.md) are at minimal risk because the exploit is limited to the containerized filesystem.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/charmbracelet/charm | 0.12.1 | GHSA-4wpp-w5r4-7v5v |
| Go | github.com/charmbracelet/charm | 0.12.1 | GO-2022-0449 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| charmbracelet | charm | >= 0.9.0, < 0.12.1 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N