Vulnerability Details : CVE-2017-6201
Potential exploit
A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote attacker may exploit this issue by providing a URL. It could bypass access control such as firewalls that prevent the attackers from accessing the URLs directly.
Vulnerability category: Server-side request forgery (SSRF)
Products affected by CVE-2017-6201
- cpe:2.3:a:sandstorm:sandstorm:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-6201
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 21 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-6201
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:N |
8.0
|
4.9
|
NIST | |
|
8.1
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
2.8
|
5.2
|
NIST |
CWE ids for CVE-2017-6201
-
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-6201
-
https://github.com/sandstorm-io/sandstorm/commit/164997fb958effbc90c5328c166706280a84aaa1
Implement IP blacklist for user-initiated requests. · sandstorm-io/sandstorm@164997f · GitHubPatch;Third Party Advisory
-
https://sandstorm.io/news/2017-03-02-security-review
Sandstorm gets a security review - Sandstorm BlogVendor Advisory
-
https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/
Sandstorm Security Review | DEVCOREExploit;Third Party Advisory
Jump to