CVE-2017-18638: graphite.composer.views.send_email vulnerable to SSRF

CVE-2017-18638 · Severity: low · CVSS 3.1 · Published 2019-10-11

send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.

Technologies: graphite-web (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2017-18638 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2017-18638 being exploited in the wild.
How severe is CVE-2017-18638?
Low severity, with a CVSS score of 3.1, published 11 October 2019.
Which products and versions are affected?
graphite-web (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.6.
Is there a fix for CVE-2017-18638?
Yes. graphite-web (PyPI): upgrade to 1.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2017-18638?
Check whether you run graphite-web (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • graphite-web (PyPI): upgrade to 1.1.6 or later
    pip install "graphite-web>=1.1.6"

Affected products

  • graphite-web (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.6

Identifiers

  • CVE-2017-18638
  • GHSA-vfj6-275q-4pvm
  • PYSEC-2019-151

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.