Server-Side Request Forgery (SSRF) Affecting splash package, versions [0,)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-SPLASH-1050182
- published 28 Feb 2021
- disclosed 10 Dec 2020
- credit Claudio Salazar (@csalazar)
How to fix?
There is no fixed version for splash.
Overview
splash is a javascript rendering service with an HTTP API. It’s a lightweight browser with an HTTP API, implemented in Python 3 using Twisted and QT5. It’s fast, lightweight and state-less which makes it easy to distribute.
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via a number of Splash API endpoints (e.g., execute, run). An attacker could send a crafted request to a Splash endpoint, forcing the Splash server to send a further request to the target server.
Furthermore, because Splash processes URLs with the localhost fully-qualified domain name as referring to the Splash server, an attacker need not know the address of the Splash server. Instead scrapers that implement Splash can be exploited if they visit a remote page that contains such a crafted input (see referenced PoC).
PoC by Claudio Salazar