A Server-Side Request Forgery (SSRF) vulnerability exists in the eventmesh-runtime module in WebhookUtil.java across Windows, Linux, and macOS. This flaw allows attackers to exploit server functionality to read or update internal resources. Users are advised to upgrade to version 1.12.0 or use the master branch to mitigate this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.3 | CVE-2024-39954 |
Exploitation
To exploit this vulnerability, an attacker must have network access to the affected server and can craft requests that leverage the SSRF flaw to access internal resources. This may involve sending specially crafted webhook requests that the server processes, allowing the attacker to read sensitive data or manipulate internal services.
Affected Products
- eventmesh-runtime module: A core component that handles webhook functionality, vulnerable to SSRF attacks.
Mitigation
To mitigate this vulnerability, users should upgrade to version 1.12.0 of the eventmesh-runtime module or utilize the master branch, which contains the necessary fixes to address the SSRF issue.