CVE-2024-43371

Advisory

Several CKAN plugins, including XLoader, DataPusher, Resource Proxy, and ckanext-archiver, are vulnerable to SSRF attacks due to a lack of URL validation. Malicious users can exploit these plugins by creating resources with URLs that access unauthorized locations. To mitigate this, users should use an HTTP proxy, implement firewall rules, or apply custom URL validators. The latest plugin versions support the ckan.download_proxy setting.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/ckan/ckan/commit/382beaec98cb331f2a030459ef043c50eaf5ad53
• https://github.com/advisories/GHSA-g9ph-j5vj-f8wm
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43371