Description
Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can target loopback, private-network and cloud metadata addresses with custom headers and redirects followed, reading non-2xx response bodies returned in the API response.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rustrak | rustrak | < 0.26.0 | 0.26.0 |
References
- https://github.com/rustrak/rustrak/issues/504 issue-tracking
- https://github.com/rustrak/rustrak/pull/525 patch issue-tracking
- https://github.com/rustrak/rustrak/commit/f41c464ec56954b1876062d70aef920e786ca40b patch
- Rustrak v0.26.0 Release Notes release-notes
- https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/services/notification/webhook.rs#L161-L250 technical-description
- https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/routes/alerts.rs#L422-L479 technical-description
- VulnCheck Advisory: Rustrak before 0.26.0 SSRF via Alert Integration Test routing_override.url third-party-advisory