.. / CVE-2020-5412

• SSRF
• Nuclei
• Web

Exploit for Spring Cloud Netflix - Server-Side Request Forgery (CVE-2020-5412)

Description:

Spring Cloud Netflix 2.2.x prior to 2.2.4, 2.1.x prior to 2.1.6, and older unsupported versions are susceptible to server-side request forgery. Applications can use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. An attacker can send a request to other servers and thus potentially access sensitive information, modify data, and/or execute unauthorized operations.

Nuclei Template

View the template here CVE-2020-5412.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-5412.yaml

References: