Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has been fixed in version 1.5.0. To workaround this issue, disable the search endpoint with --enable_retrieve_api=false.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

服务端请求伪造(SSRF)

Rekor 代码问题漏洞

Rekor是sigstore开源的一款开源软件，能够为软件项目供应链中生成的元数据提供一个不可变的防篡改分类账。 Rekor 1.4.3及之前版本存在代码问题漏洞，该漏洞源于/api/v1/index/retrieve支持通过用户提供的URL检索公钥，可能导致服务端请求伪造攻击。

N/A

N/A