Executive brief
TerriaJS terriajs-server is a Node.js proxy component used to forward HTTP requests for mapping and geospatial data visualization applications. A server-side request forgery (SSRF) vulnerability allows attackers with access to a whitelisted server or ability to modify DNS records to use the proxy to access private resources on the hosting infrastructure, including internal services and databases not intended to be publicly accessible.
Technical details
The vulnerability is a Server-Side Request Forgery (CWE-918) in terriajs-server versions prior to 2.7.4. The proxy component fails to properly validate hostnames and filter IP addresses on redirect responses, allowing an attacker to bypass whitelist restrictions through DNS manipulation or by controlling a whitelisted domain. An attacker can exploit this by crafting requests that cause the proxy to redirect to and access arbitrary HTTP-accessible resources within the hosting environment, including internal services. The fix (commit 3cbc484) implements an IP address blacklist and validates hostnames on redirect. Upgrade to version 2.7.4 or later to remediate.
Affected products
- TerriaJS terriajs-server < 2.7.4
Timeline
- 2019-05-29: disclosed
- 2018-08-17: patched: Fix committed prior to public disclosure