Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio
Vulnerability Description
WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via “TestRequester” functionality, webhooks and the proxy mode. As we can control HTTP Method, HTTP Headers, HTTP Data, it allows sending requests with the default level of credentials for the WireMock instance. The vendor has discontinued the affected Wiremock studio product and there will be no fix. Users are advised to find alternatives.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
WireMock 代码问题漏洞
Vulnerability Description
WireMock是WireMock开源的一种流行的API模拟测试开源工具。 WireMock存在代码问题漏洞，该漏洞源于当WireMock Studio配置字段中使用某些请求URL时，该请求可能会转发到可从WireMock实例访问的任意服务。
CVSS Information
N/A
Vulnerability Type
N/A