Vulnerabilities > CVE-2019-7652 - Server-Side Request Forgery (SSRF) vulnerability in Thehive-Project Cortex-Analyzers

CVSS 7.7 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

thehive-project

CWE-918

exploit available

NVD

Published: 2019-05-09

Updated: 2024-11-21

Summary

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be seen in the main dashboard. Thus, it is possible to do port scans on localhost and intranet hosts.

Vulnerable Configurations

Part	Description	Count
Application	Thehive-Project Thehive Project Cortex Analyzers 1.0.0 Thehive Project Cortex Analyzers 1.1.0 Thehive Project Cortex Analyzers 1.2.0 Thehive Project Cortex Analyzers 1.3.0 Thehive Project Cortex Analyzers 1.3.1 Thehive Project Cortex Analyzers 1.4.0 Thehive Project Cortex Analyzers 1.4.1 Thehive Project Cortex Analyzers 1.4.2 Thehive Project Cortex Analyzers 1.4.3 Thehive Project Cortex Analyzers 1.4.4 Thehive Project Cortex Analyzers 1.5.0 Thehive Project Cortex Analyzers 1.5.1 Thehive Project Cortex Analyzers 1.6.0 Thehive Project Cortex Analyzers 1.6.1 Thehive Project Cortex Analyzers 1.6.2 Thehive Project Cortex Analyzers 1.6.3 Thehive Project Cortex Analyzers 1.6.4 Thehive Project Cortex Analyzers 1.6.5 Thehive Project Cortex Analyzers 1.7.0 Thehive Project Cortex Analyzers 1.7.1 Thehive Project Cortex Analyzers 1.8.0 Thehive Project Cortex Analyzers 1.8.1 Thehive Project Cortex Analyzers 1.8.2 Thehive Project Cortex Analyzers 1.8.3 Thehive Project Cortex Analyzers 1.9.0 Thehive Project Cortex Analyzers 1.9.1 Thehive Project Cortex Analyzers 1.9.2 Thehive Project Cortex Analyzers 1.9.3 Thehive Project Cortex Analyzers 1.9.4 Thehive Project Cortex Analyzers 1.9.5 Thehive Project Cortex Analyzers 1.9.6 Thehive Project Cortex Analyzers 1.9.7 Thehive Project Cortex Analyzers 1.10.0 Thehive Project Cortex Analyzers 1.10.1 Thehive Project Cortex Analyzers 1.10.2 Thehive Project Cortex Analyzers 1.10.3 Thehive Project Cortex Analyzers 1.10.4 Thehive Project Cortex Analyzers 1.11.0 Thehive Project Cortex Analyzers 1.12.0 Thehive Project Cortex Analyzers 1.13.0 Thehive Project Cortex Analyzers 1.13.1 Thehive Project Cortex Analyzers 1.13.2 Thehive Project Cortex Analyzers 1.14.0 Thehive Project Cortex Analyzers 1.14.1 Thehive Project Cortex Analyzers 1.14.2 Thehive Project Cortex Analyzers 1.14.3 Thehive Project Cortex Analyzers 1.14.4 Thehive Project Cortex Analyzers 1.15.0 Thehive Project Cortex Analyzers 1.15.1	49

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Exploit-Db

id	EDB-ID:46820
last seen	2019-05-10
modified	2019-05-10
published	2019-05-10
reporter	Exploit-DB
source	https://www.exploit-db.com/download/46820
title	TheHive Project Cortex < 1.15.2 - Server-Side Request Forgery

Packetstorm

data source	https://packetstormsecurity.com/files/download/152804/thehivepc-ssrf.txt
id	PACKETSTORM:152804
last seen	2019-05-11
published	2019-05-10
reporter	Alexandre Basquin
source	https://packetstormsecurity.com/files/152804/TheHive-Project-Cortex-2.1.3-Server-Side-Request-Forgery.html
title	TheHive Project Cortex 2.1.3 Server Side Request Forgery

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Exploit-Db

Packetstorm

References