Server-Side Request Forgery (SSRF) Affecting splash package, versions [0,)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Server-Side Request Forgery (SSRF) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PYTHON-SPLASH-1050182
  • published28 Feb 2021
  • disclosed10 Dec 2020
  • creditClaudio Salazar (@csalazar)

Introduced: 10 Dec 2020

CVE NOT AVAILABLE CWE-918  (opens in a new tab)

How to fix?

There is no fixed version for splash.

Overview

splash is a javascript rendering service with an HTTP API. It’s a lightweight browser with an HTTP API, implemented in Python 3 using Twisted and QT5. It’s fast, lightweight and state-less which makes it easy to distribute.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via a number of Splash API endpoints (e.g., execute, run). An attacker could send a crafted request to a Splash endpoint, forcing the Splash server to send a further request to the target server.

Furthermore, because Splash processes URLs with the localhost fully-qualified domain name as referring to the Splash server, an attacker need not know the address of the Splash server. Instead scrapers that implement Splash can be exploited if they visit a remote page that contains such a crafted input (see referenced PoC).

PoC by Claudio Salazar


CVSS Scores

version 3.1