Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-25850
CVE-2022-25850:
vulnerability analysis and mitigation
Overview
The package github.com/hoppscotch/proxyscotch before version 1.0.0 was found to be vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. The vulnerability was discovered and disclosed on March 29, 2022, and was assigned CVE-2022-25850 (Snyk).
Technical details
The vulnerability occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. The CVSS v3.1 base score for this vulnerability is 7.5 (High), with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, Confidentiality: High, Integrity: None, Availability: None (Snyk).
Impact
The exploitation of this vulnerability leads to a leakage of sensitive information from the server. The confidentiality impact is rated as High, indicating that there could be a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker (Snyk).
Mitigation and workarounds
The recommended mitigation is to upgrade github.com/hoppscotch/proxyscotch to version 1.0.0 or higher. A patch was implemented that adds the ability to have a blacklist of target URLs for the proxy to make calls to (GitHub Commit).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management