Impact
This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request.
Patches
Issue has been patched in eLabFTW 4.0.0.
Workarounds
You can apply this commit if you cannot upgrade: 3d2db4d
References
This issue has been found and responsibly disclosed through proper channels by Rafal Lykowski (@mgrRaf) and Piyush Patil (@xoffense).
More information on the vulnerability can be found in this presentation: https://docs.google.com/presentation/d/1vMbvg05euZdq1wDxtR04EvC6iBiyIbcFeRAHWr1McdA/htmlpresent
For more information
If you have any questions or comments about this advisory:
Impact
This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request.
Patches
Issue has been patched in eLabFTW 4.0.0.
Workarounds
You can apply this commit if you cannot upgrade: 3d2db4d
References
This issue has been found and responsibly disclosed through proper channels by Rafal Lykowski (@mgrRaf) and Piyush Patil (@xoffense).
More information on the vulnerability can be found in this presentation: https://docs.google.com/presentation/d/1vMbvg05euZdq1wDxtR04EvC6iBiyIbcFeRAHWr1McdA/htmlpresent
For more information
If you have any questions or comments about this advisory: