CVE-2024-6538

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-6538
A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system. The /api/dev-console/proxy/internet endpoint on the OpenShift Console allows authenticated users to have the console's pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint. While the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2024-6538
https://bugzilla.redhat.com/show_bug.cgi?id=2296057
Configurations

No configuration.

History

26 Apr 2025, 04:15

Type Values Removed Values Added
Summary
  • (es) Se encontró una falla en la consola OpenShift. Un ataque de server-side request forgery (SSRF) puede ocurrir si un atacante proporciona toda o parte de una URL al servidor para realizar una consulta. Se considera que el servidor está en una posición de red privilegiada y, a menudo, puede acceder a servicios expuestos que no están disponibles para los clientes debido al filtrado de la red. Al aprovechar este vector de ataque, el atacante puede tener un impacto en otros servicios y potencialmente divulgar información o tener otros efectos nefastos en el sistema. El endpoint /api/dev-console/proxy/internet en la consola OpenShift permite que los usuarios autenticados hagan que el pod de la consola realice solicitudes HTTP arbitrarias y completamente controladas. El endpoint devuelve la respuesta completa a estas solicitudes. Si bien el nombre de este endpoint sugiere que las solicitudes solo están vinculadas a Internet, no existen tales controles. Por lo tanto, un usuario autenticado puede solicitar a la consola que realice solicitudes HTTP arbitrarias desde fuera del clúster a un servicio dentro del clúster.
Summary (en) A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system. The /api/dev-console/proxy/internet endpoint on the OpenShit Console allows authenticated users to have the console's pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint. While the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster. (en) A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system. The /api/dev-console/proxy/internet endpoint on the OpenShift Console allows authenticated users to have the console's pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint. While the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster.

25 Nov 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-25 07:15

Updated : 2025-04-26 04:15

NVD link : CVE-2024-6538

Mitre link : CVE-2024-6538

CVE.ORG link : CVE-2024-6538

JSON object : View

Products Affected

No product.

CWE
CWE-918

Server-Side Request Forgery (SSRF)