Cache Manipulation Attack Affecting github.com/apache/trafficcontrol/traffic_ops/ort/atstccfg/config package, versions >=3.0.0 <4.1.1


0.0
high
  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-GOLANG-GITHUBCOMAPACHETRAFFICCONTROLTRAFFICOPSORTATSTCCFGCONFIG-1065273

  • published

    27 Jan 2021

  • disclosed

    27 Jan 2021

  • credit

    Unknown

How to fix?

Upgrade github.com/apache/trafficcontrol/traffic_ops/ort/atstccfg/config to version 4.1.1 or higher.

Overview

github.com/apache/trafficcontrol/traffic_ops/ort/atstccfg/config is an Open Source implementation of a Content Delivery Network.

Affected versions of this package are vulnerable to Cache Manipulation Attack when ORT generates ip_allow.config files via atstccfg. Those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN architecture.