GHSA-fvx3-g627-phm2

Server-Side Request Forgery (SSRF) in com.ctrip.framework.apollo:apollo

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10686

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.ctrip.framework.apollo:apollo	<= 1.3.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via `/system-info/health` because the `%23` substring is mishandled.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10686 advisory
https://github.com/ctripcorp/apollo/issues/2103 web
https://github.com/advisories/GHSA-fvx3-g627-phm2 advisory
https://github.com/ctripcorp/apollo package