CVE-2024-41668: SSRF in cBioPortal for Cancer Genomics

The SSRF vulnerability in cBioPortal allows an attacker to craft malicious requests that the server will execute on their behalf. In a publicly exposed instance, this could allow an attacker to scan internal networks, access sensitive data stored behind firewalls, or even interact with internal services. Even in private, authenticated instances, logged-in users could leverage this vulnerability to access resources they shouldn't. The potential impact ranges from information disclosure to complete compromise of the underlying infrastructure, depending on the resources accessible via the SSRF. This vulnerability shares similarities with other SSRF exploits where attackers leverage the server's trust to bypass security controls.

1. Reserved2024-07-18
2. Published2024-07-23
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-41668 is to upgrade cBioPortal to version 6.0.12 or later, which includes a fix for the SSRF vulnerability. If upgrading immediately is not possible, a temporary workaround is to disable the /proxy endpoint entirely. This can be achieved using a reverse proxy like Nginx, configuring it to block requests to the /proxy path. Ensure that your Nginx configuration explicitly denies access to this endpoint. After upgrading, verify the fix by attempting to access an internal resource through the /proxy endpoint; the request should be denied.