cvelistv5 - cve-2024-32980

CVE-2024-32980 (GCVE-0-2024-32980)

Vulnerability from cvelistv5 – Published: 2024-05-08 14:32 – Updated: 2024-08-02 02:27

Title

Spin contains a potential network sandbox escape for specifically configured Spin applications

Summary

Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application's component handling the incoming request is configured with an `allow_outbound_hosts` list containing `"self"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port. Spin 2.4.3 has been released to fix this issue.

Severity ?

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Assigner

GitHub_M

References

URL

Tags

	https://github.com/fermyon/spin/security/advisori…	x_refsource_CONFIRM
	https://github.com/fermyon/spin/commit/b3db535c9e…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	fermyon	spin	Affected: < 2.4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32980",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:22:02.566817Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:22:32.670Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:27:53.504Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh"
          },
          {
            "name": "https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "spin",
          "vendor": "fermyon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application\u0027s component handling the incoming request is configured with an `allow_outbound_hosts` list containing `\"self\"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn\u0027t include the hostname/port. Spin 2.4.3 has been released to fix this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-610",
              "description": "CWE-610: Externally Controlled Reference to a Resource in Another Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-08T14:32:09.059Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh"
        },
        {
          "name": "https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354"
        }
      ],
      "source": {
        "advisory": "GHSA-f3h7-gpjj-wcvh",
        "discovery": "UNKNOWN"
      },
      "title": "Spin contains a potential network sandbox escape for specifically configured Spin applications"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-32980",
    "datePublished": "2024-05-08T14:32:09.059Z",
    "dateReserved": "2024-04-22T15:14:59.166Z",
    "dateUpdated": "2024-08-02T02:27:53.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application\u0027s component handling the incoming request is configured with an `allow_outbound_hosts` list containing `\\\"self\\\"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn\u0027t include the hostname/port. Spin 2.4.3 has been released to fix this issue.\"}, {\"lang\": \"es\", \"value\": \"Spin es la herramienta de desarrollo para crear y ejecutar aplicaciones sin servidor impulsadas por WebAssembly. Antes de 2.4.3, algunas aplicaciones Spin configuradas espec\\u00edficamente que usan solicitudes \\\"autom\\u00e1ticas\\\" sin una autoridad de URL especificada pueden ser inducidas a realizar solicitudes a hosts arbitrarios a trav\\u00e9s del encabezado HTTP \\\"Host\\\". Se deben cumplir las siguientes condiciones para que una aplicaci\\u00f3n sea vulnerable: 1. El entorno Spin se implementa en rutas de solicitudes al tiempo de ejecuci\\u00f3n de Spin seg\\u00fan la URL de solicitud en lugar del encabezado \\\"Host\\\", y deja el encabezado \\\"Host\\\" configurado en su valor original; 2. El componente de la aplicaci\\u00f3n Spin que maneja la solicitud entrante est\\u00e1 configurado con una lista `allow_outbound_hosts` que contiene `\\\"self\\\"`; y 3. En reacci\\u00f3n a una solicitud entrante, el componente realiza una solicitud saliente cuya URL no incluye el nombre de host/puerto. Se lanz\\u00f3 Spin 2.4.3 para solucionar este problema.\"}]",
      "id": "CVE-2024-32980",
      "lastModified": "2024-11-21T09:16:09.580",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.2}]}",
      "published": "2024-05-08T15:15:10.530",
      "references": "[{\"url\": \"https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-610\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-32980\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-05-08T15:15:10.530\",\"lastModified\":\"2024-11-21T09:16:09.580\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application\u0027s component handling the incoming request is configured with an `allow_outbound_hosts` list containing `\\\"self\\\"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn\u0027t include the hostname/port. Spin 2.4.3 has been released to fix this issue.\"},{\"lang\":\"es\",\"value\":\"Spin es la herramienta de desarrollo para crear y ejecutar aplicaciones sin servidor impulsadas por WebAssembly. Antes de 2.4.3, algunas aplicaciones Spin configuradas espec\u00edficamente que usan solicitudes \\\"autom\u00e1ticas\\\" sin una autoridad de URL especificada pueden ser inducidas a realizar solicitudes a hosts arbitrarios a trav\u00e9s del encabezado HTTP \\\"Host\\\". Se deben cumplir las siguientes condiciones para que una aplicaci\u00f3n sea vulnerable: 1. El entorno Spin se implementa en rutas de solicitudes al tiempo de ejecuci\u00f3n de Spin seg\u00fan la URL de solicitud en lugar del encabezado \\\"Host\\\", y deja el encabezado \\\"Host\\\" configurado en su valor original; 2. El componente de la aplicaci\u00f3n Spin que maneja la solicitud entrante est\u00e1 configurado con una lista `allow_outbound_hosts` que contiene `\\\"self\\\"`; y 3. En reacci\u00f3n a una solicitud entrante, el componente realiza una solicitud saliente cuya URL no incluye el nombre de host/puerto. Se lanz\u00f3 Spin 2.4.3 para solucionar este problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-610\"}]}],\"references\":[{\"url\":\"https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh\", \"name\": \"https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354\", \"name\": \"https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T02:27:53.504Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-32980\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T17:22:02.566817Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T17:22:11.701Z\"}}], \"cna\": {\"title\": \"Spin contains a potential network sandbox escape for specifically configured Spin applications\", \"source\": {\"advisory\": \"GHSA-f3h7-gpjj-wcvh\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"fermyon\", \"product\": \"spin\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.4.3\"}]}], \"references\": [{\"url\": \"https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh\", \"name\": \"https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354\", \"name\": \"https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application\u0027s component handling the incoming request is configured with an `allow_outbound_hosts` list containing `\\\"self\\\"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn\u0027t include the hostname/port. Spin 2.4.3 has been released to fix this issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-610\", \"description\": \"CWE-610: Externally Controlled Reference to a Resource in Another Sphere\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-05-08T14:32:09.059Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-32980\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T02:27:53.504Z\", \"dateReserved\": \"2024-04-22T15:14:59.166Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-05-08T14:32:09.059Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-32980

Vulnerability from fkie_nvd - Published: 2024-05-08 15:15 - Updated: 2024-11-21 09:16

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354
	security-advisories@github.com	https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application\u0027s component handling the incoming request is configured with an `allow_outbound_hosts` list containing `\"self\"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn\u0027t include the hostname/port. Spin 2.4.3 has been released to fix this issue."
    },
    {
      "lang": "es",
      "value": "Spin es la herramienta de desarrollo para crear y ejecutar aplicaciones sin servidor impulsadas por WebAssembly. Antes de 2.4.3, algunas aplicaciones Spin configuradas espec\u00edficamente que usan solicitudes \"autom\u00e1ticas\" sin una autoridad de URL especificada pueden ser inducidas a realizar solicitudes a hosts arbitrarios a trav\u00e9s del encabezado HTTP \"Host\". Se deben cumplir las siguientes condiciones para que una aplicaci\u00f3n sea vulnerable: 1. El entorno Spin se implementa en rutas de solicitudes al tiempo de ejecuci\u00f3n de Spin seg\u00fan la URL de solicitud en lugar del encabezado \"Host\", y deja el encabezado \"Host\" configurado en su valor original; 2. El componente de la aplicaci\u00f3n Spin que maneja la solicitud entrante est\u00e1 configurado con una lista `allow_outbound_hosts` que contiene `\"self\"`; y 3. En reacci\u00f3n a una solicitud entrante, el componente realiza una solicitud saliente cuya URL no incluye el nombre de host/puerto. Se lanz\u00f3 Spin 2.4.3 para solucionar este problema."
    }
  ],
  "id": "CVE-2024-32980",
  "lastModified": "2024-11-21T09:16:09.580",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-05-08T15:15:10.530",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-610"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GSD-2024-32980

Vulnerability from gsd - Updated: 2024-04-23 05:02

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2024-32980

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-32980"
      ],
      "id": "GSD-2024-32980",
      "modified": "2024-04-23T05:02:10.513446Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-32980",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

GHSA-F3H7-GPJJ-WCVH

Vulnerability from github – Published: 2024-05-08 17:50 – Updated: 2024-05-08 17:50

Summary

Spin applications with specific configuration vulnerable to potential network sandbox escape

Details

Impact

Some specifically configured Spin applications that use self requests without a specified URL authority can be induced to make requests to arbitrary hosts via the Host HTTP header.

If an application's manifest contains a component with configuration such as

allowed_outbound_hosts = ["http://self", "https://self"]

and code such as

 let res: Response = spin_sdk::http::send(
        Request::new(Method::Get, "/") // Note: the request URI does not contain a URL authority
 ).await?;

Then that application can be induced to send an outgoing request to another host (leading the app to process the response assuming it comes from another component in the same application). This can be induced with a request such as

curl -H"Host: google.com:80" localhost:3000 # Assuming the application is served on localhost:3000

Note: If using a SDK that does not use wasi:http/outgoing-handler, the port can be omitted from the URL.

Vulnerable Configurations

The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the Host header, and leaves the Host header set to the original value by the client. 2. The Spin application's component handling the incoming request is configured with an allowed_outbound_hosts list containing "self". 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port.

If all of these conditions apply, then Spin will use the inbound request's Host header to determine the authority part of the URL if none is explicitly provided in the request's URL.

Setups known not to be vulnerable

Fermyon's Fermyon Cloud serverless product and applications hosted on it are known not to be vulnerable.

Patches

Has the problem been patched? What versions should users upgrade to? Spin version 2.4.3 is being released with this advisory going public.

Workarounds

For deployments of Spin, a workaround is to ensure that the Host header is sanitized to match the application a request is routed to.

For individual applications, multiple workarounds exist: 1. Ensure that outgoing requests always sanitize the Host header 2. Ensure that outgoing requests always provide the hostname in the URL and use that hostname in the allowed_outbound_hosts list instead of self 3. When using Spin 2.4, use application-internal service chaining for intra-application requests

Severity ?

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "spin-sdk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-32980"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-08T17:50:49Z",
    "nvd_published_at": "2024-05-08T15:15:10Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nSome specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header.\n\nIf an application\u0027s manifest contains a component with configuration such as\n```toml\nallowed_outbound_hosts = [\"http://self\", \"https://self\"]\n```\n\nand code such as\n```rust\n let res: Response = spin_sdk::http::send(\n        Request::new(Method::Get, \"/\") // Note: the request URI does not contain a URL authority\n ).await?;\n```\n\nThen that application can be induced to send an outgoing request to another host (leading the app to process the response assuming it comes from another component in the same application). This can be induced with a request such as\n```shell\ncurl -H\"Host: google.com:80\" localhost:3000 # Assuming the application is served on localhost:3000\n```\n\n\u003e Note: If using a SDK that does not use `wasi:http/outgoing-handler`, the port can be omitted from the URL.\n\n#### Vulnerable Configurations\n\nThe following conditions need to be met for an application to be vulnerable:\n1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to the original value by the client.\n2. The Spin application\u0027s component handling the incoming request is configured with an `allowed_outbound_hosts` list containing `\"self\"`.\n3. In reaction to an incoming request, the component makes an outbound request whose URL doesn\u0027t include the hostname/port.\n\nIf all of these conditions apply, then Spin will use the inbound request\u0027s `Host` header to determine the `authority` part of the URL if none is explicitly provided in the request\u0027s URL.\n\n#### Setups known not to be vulnerable\n\nFermyon\u0027s [Fermyon Cloud](https://developer.fermyon.com/cloud/index) serverless product and applications hosted on it are known not to be vulnerable.\n\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nSpin version 2.4.3 is being released with this advisory going public.\n\n### Workarounds\nFor deployments of Spin, a workaround is to ensure that the `Host` header is sanitized to match the application a request is routed to.\n\nFor individual applications, multiple workarounds exist:\n1. Ensure that outgoing requests always sanitize the `Host` header\n2. Ensure that outgoing requests always provide the hostname in the URL and use that hostname in the `allowed_outbound_hosts` list instead of `self`\n3. When using Spin 2.4, use [application-internal service chaining](https://developer.fermyon.com/spin/v2/http-outbound#local-service-chaining) for intra-application requests\n",
  "id": "GHSA-f3h7-gpjj-wcvh",
  "modified": "2024-05-08T17:50:49Z",
  "published": "2024-05-08T17:50:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32980"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fermyon/spin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spin applications with specific configuration vulnerable to potential network sandbox escape"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-32980 (GCVE-0-2024-32980)

FKIE_CVE-2024-32980

GSD-2024-32980

GHSA-F3H7-GPJJ-WCVH

Impact

Vulnerable Configurations

Setups known not to be vulnerable

Patches

Workarounds

Tags

Sightings

Nomenclature