github.com/apache/trafficcontrol 中的 Apache Traffic Control 存在服务器端请求伪造漏洞

The SSRF vulnerability in Apache Traffic Control allows an attacker to craft malicious requests that the Traffic Control server will execute on behalf of the attacker. This can lead to several serious consequences. An attacker could potentially access internal services that are not directly exposed to the internet, such as databases, configuration files, or other administrative interfaces. Furthermore, an attacker could use the SSRF vulnerability to scan internal networks, identify other vulnerable services, and potentially escalate their attack. The blast radius extends to any internal resources accessible via HTTP/HTTPS from the Traffic Control server.

Organizations utilizing Apache Traffic Control for managing their network infrastructure are at risk. This includes those with complex internal networks and services that are not directly exposed to the internet. Shared hosting environments where multiple users share a Traffic Control instance are particularly vulnerable, as a compromised user could potentially exploit the SSRF vulnerability to access resources belonging to other users.

• linux / server: Monitor Traffic Control logs for outbound requests to unexpected internal or external IP addresses. Use journalctl -u trafficcontrol to filter for HTTP requests.

journalctl -u trafficcontrol | grep -i 'http:' | grep -v '127.0.0.1'

• generic web: Use curl to test for SSRF by attempting to access internal resources through the Traffic Control server.

curl http://localhost:8080/internal_resource

• generic web: Examine access logs for unusual outbound requests originating from the Traffic Control server's IP address.

1. 2024-08-21Disclosure

   disclosure

1. 已保留2022-01-13
2. 发布日期2024-08-21
3. 修改日期2026-03-03
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2022-23206 is to upgrade Apache Traffic Control to version 5.1.6+incompatible or later. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict network access to the Traffic Control server to only necessary IP addresses and ports. Implement strict input validation and sanitization to prevent attackers from crafting malicious URLs. Web Application Firewalls (WAFs) can be configured to block suspicious outgoing requests based on URL patterns and destination IP addresses. Monitor Traffic Control logs for unusual outbound requests.