Description
Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring by VMware | Spring Cloud Netflix | 2.2 – < 2.2.4, 2.1 – < 2.1.6 | 2.2.4 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Spring Cloud Netflix - Server-Side Request Forgery http/cves/2020/CVE-2020-5412.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-netflix | >= 2.2.0, < 2.2.4 | 2.2.4 | GHSA-qgcg-p3v2-9h4p |
| Maven | org.springframework.cloud:spring-cloud-netflix | >= 2.1.0, < 2.1.6 | 2.1.6 | GHSA-qgcg-p3v2-9h4p |