Description
Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queue_url to the create-source API to scan internal networks and fingerprint services based on connection response differences.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
quickwit-oss quickwit
Default version status: unaffected
0 to ≤ 0.9.0affected
References
- https://github.com/quickwit-oss/quickwit/issues/6703 ↗
- https://github.com/quickwit-oss/quickwit ↗
- https://github.com/quickwit-oss/quickwit/blob/v0.9.0/quickwit/quickwit-serve/src/index_api/source_resource.rs#L56-L66 ↗
- https://github.com/quickwit-oss/quickwit/blob/v0.9.0/quickwit/quickwit-indexing/src/source/queue_sources/sqs_queue.rs#L230-L243 ↗
- https://www.vulncheck.com/advisories/quickwit-through-0.9.0-ssrf-via-sqs-queue-url-parameter ↗