Cache Manipulation Attack Affecting package, versions >=3.0.0 <4.1.1

  • Attack Complexity


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    27 Jan 2021

  • disclosed

    27 Jan 2021

  • credit


How to fix?

Upgrade to version 4.1.1 or higher.

Overview is an Open Source implementation of a Content Delivery Network.

Affected versions of this package are vulnerable to Cache Manipulation Attack when ORT generates ip_allow.config files via atstccfg. Those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN architecture.