Vulnerability · Published Dec 1, 2023 · Assigned by GitHub_M

CVE-2023-46746Authenticated PostHog users vulnerable to SSRF

Medium 4.8

In plain English

A medium-severity server-side request forgery in posthog from PostHog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.4%top 67.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side request forgery (SSRF), which can only be exploited by authenticated users, was found in Posthog. Posthog did not verify whether a URL was local when enabling webhooks, allowing authenticated users to forge a POST request. This vulnerability has been addressed in `22bd5942` and will be included in subsequent releases. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
PostHog	posthog	<=1.43.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/PostHog/posthog/security/advisories/GHSA-wqqw-r8c5-j67c x_refsource_CONFIRM
https://github.com/PostHog/posthog/commit/22bd5942638d5d9bc4bd603a9bfe8f8a95572292 x_refsource_MISC
https://securitylab.github.com/advisories/GHSL-2023-185_posthog_posthog/ x_refsource_MISC