Vulnerability · Published Sep 2, 2022 · Assigned by GitHub_M

CVE-2022-31196Server-Side Request Forgery (SSRF) vulnerability in Databasir

High 7.6

In plain English

A high-severity server-side request forgery in databasir from vran-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)1.1%top 35.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Databasir is a database metadata management platform. Databasir <= 1.06 has Server-Side Request Forgery (SSRF) vulnerability. The SSRF is triggered by a sending a **single** HTTP POST request to create a databaseType. By supplying a `jdbcDriverFileUrl` that returns a non `200` response code, the url is executed, the response is logged (both in terminal and in database) and is included in the response. This would allow an attackers to obtain the real IP address and scan Intranet information. This issue was fixed in version 1.0.7.

Affected products (as reported)

Vendor	Product	Versions
vran-dev	databasir	< 1.0.7

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

https://github.com/vran-dev/databasir/security/advisories/GHSA-qvg8-427f-852q x_refsource_CONFIRM
https://github.com/vran-dev/databasir/commit/226c20e0c9124037671a91d6b3e5083bd2462058 x_refsource_MISC
https://github.com/vran-dev/databasir/releases/tag/v1.0.7 x_refsource_MISC