CVE description
The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port. This allowed requests to be directed to internal services listening on other ports of the appliance.
Response bodies were not returned, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance.
Exploitation required network access to the instance. It was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled.
CVSS metrics
| Version | 4.0 |
|---|---|
| Score | 9.3 — Critical |
| Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| Attack vector | Network |
| Attack complexity | Low |
| Attack requirements | None |
| Privileges required | None when private mode is disabled; any authenticated user when private mode is enabled. |
| User interaction | None |
| Impact | High confidentiality, integrity, and availability impact. |
Related weaknesses and remediation
CWE-918 — Server-Side Request Forgery. The server retrieves a user-supplied URL without sufficiently ensuring that the request reaches the expected destination.
CWE-208 — Observable Timing Discrepancy. Differences in operation timing can reveal security-relevant information.
Affected versions: 3.17 through 3.22. Fixed in 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. FXeSEC recommends applying the fixed release.