SB2024081715 - Server-Side Request Forgery (SSRF) in TruffleHog

Description

This security bulletin contains information about 1 security vulnerability.

1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-43379)

The vulnerability allows a remote attacker to trigger unauthorized requests to attacker-chosen endpoints.

The vulnerability exists due to server-side request forgery in some detectors when scanning maliciously crafted data. A remote attacker can craft data that causes the detector to send a request to an attacker-chosen endpoint to trigger unauthorized requests to attacker-chosen endpoints.

User interaction is required because the victim must scan the crafted data. Exploitation is effective only if the targeted endpoint is an unauthenticated GET endpoint that produces side effects.

Remediation

Install update from vendor's website.

References

• https://github.com/trufflesecurity/trufflehog/security/advisories/GHSA-3r74-v83p-f4f4
• https://github.com/advisories/GHSA-3r74-v83p-f4f4