Description
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to internal endpoints and cloud metadata services, receiving full response bodies without authentication or validation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
datageartech datagear
Default version status: unaffected
0 to ≤ 6.0.0affected
References
- https://github.com/datageartech/datagear/issues/37 ↗
- https://github.com/datageartech/datagear ↗
- https://github.com/datageartech/datagear/blob/fedefd4269b123e1e4f3e029906ed6e6f378c989/datagear-analysis/src/main/java/org/datagear/analysis/support/HttpDataSet.java#L386-L392 ↗
- https://github.com/datageartech/datagear/blob/fedefd4269b123e1e4f3e029906ed6e6f378c989/datagear-web/src/main/java/org/datagear/web/config/SecurityConfigSupport.java#L449-L453 ↗
- https://github.com/datageartech/datagear/blob/fedefd4269b123e1e4f3e029906ed6e6f378c989/datagear-web/src/main/java/org/datagear/web/config/CoreConfigSupport.java#L386-L390 ↗
- https://www.vulncheck.com/advisories/datagear-through-6.0.0-unauthenticated-ssrf-via-http-dataset-preview ↗