CVE-2024-12867
Server-Side Request Forgery in Arctic Hub URL Mapper allows an unauthenticated remote attacker to exfiltrate and modify configurations and data
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Server-Side Request Forgery in Arctic Hub URL Mapper allows an unauthenticated remote attacker to exfiltrate and modify configurations and data
Server-Side Request Forgery in URL Mapper in Arctic Security's Arctic Hub versions 3.0.1764-5.6.1877 allows an unauthenticated remote attacker to exfiltrate and modify configurations and data.
Reserved 2024-12-20 | Published 2024-12-20 | Updated 2024-12-24 | Assigner NCSC-FICWE-918 Server-Side Request Forgery (SSRF)
| 2024-12-06: | Arctic Security received a report about a DoS vulnerability in the URL Mapper API. |
| 2024-12-09: | Arctic Security R&D team was able to replicate the DoS vulnerability. The team discovered the root cause of the DoS issue and implemented a fix on the same day. |
| 2024-12-10: | Arctic Security R&D team continued internal investigation based on the reported vulnerability and found out a way to expand it from the DoS to a SSRF. The team identified the root cause for the SSRF and started to work on a fix. The fix was finalized later on the same day. |
| 2024-12-11: | Arctic Security R&D team implemented a helper tool to assist users by 1) Implementing a hotfix to any of the earlier vulnerable versions so that users who are not able to upgrade right away can have a temporary solution. 2) By helping users to check for any suspicious activity in their logs related to the vulnerability. |
| 2024-12-12: | Arctic Security released Arctic Hub 5.6.1877 containing the fix, along with a release note to explain the vulnerability. An access link to the helper tool was provided as part of the release note. |
| 2024-12-13: | After getting confirmation from CCB that no duplicate CVE entry has been made, Arctic Security requested a CVE number from its local CNA, the National Cyber Security Centre Finland (NCSC-FI). |
Bob Van der Smissen
'Hack the Government' ethical hacking event hosted by the Centre for Cybersecurity Belgium (CCB)
www.arcticsecurity.com/...rity/vulnerability-note-2024-12-20
Support options
