cBioPortal 代理端点漏洞

The SSRF vulnerability in cBioPortal allows an attacker to craft malicious requests that the server will execute on their behalf. In a publicly exposed instance, this could allow an attacker to scan internal networks, access sensitive data stored behind firewalls, or even interact with internal services. Even in private, authenticated instances, logged-in users could leverage this vulnerability to access resources they shouldn't. The potential impact ranges from information disclosure to complete compromise of the underlying infrastructure, depending on the resources accessible via the SSRF. This vulnerability shares similarities with other SSRF exploits where attackers leverage the server's trust to bypass security controls.

Organizations running publicly accessible cBioPortal instances, particularly those with sensitive data stored on internal networks, are at significant risk. Environments where cBioPortal is integrated with other internal systems are also vulnerable, as an attacker could potentially leverage the SSRF to gain access to those systems.

• java / server: Monitor access logs for requests to the /proxy endpoint originating from unexpected sources.

grep '/proxy' /var/log/nginx/access.log | grep -v "your_trusted_ip_range"

• generic web: Use curl to attempt to access internal resources through the /proxy endpoint. A successful request indicates the vulnerability is present.

curl -v http://cbioportal_server/proxy/http://internal_resource

1. 2024-07-23Disclosure

   disclosure

1. 已保留2024-07-18
2. 发布日期2024-07-23
3. 修改日期2024-08-02
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-41668 is to upgrade cBioPortal to version 6.0.12 or later, which includes a fix for the SSRF vulnerability. If upgrading immediately is not possible, a temporary workaround is to disable the /proxy endpoint entirely. This can be achieved using a reverse proxy like Nginx, configuring it to block requests to the /proxy path. Ensure that your Nginx configuration explicitly denies access to this endpoint. After upgrading, verify the fix by attempting to access an internal resource through the /proxy endpoint; the request should be denied.