CVE-2024-43379: Github.com/trufflesecurity/trufflehog/v3 Trufflehog Vulnerable To Blind SSRF Vulnerability

LOW
Advisory Identifier: GHSA-3r74-v83p-f4f4
Share
CVSS 3.4
CWE-918
Published
Advisory Summary

CVE-2024-43379 is a LOW (CVSS 3.4) trufflehog vulnerable to blind ssrf vulnerability (CWE-918: Server-Side Request Forgery (SSRF)) affecting Github.com/trufflesecurity/trufflehog/v3 libraries in the Go ecosystem. The issue involves trufflehog vulnerable to blind ssrf in some detectors. Remediation is available by upgrading affected packages to version 3.81.9.

CVE-2024-43379 at a Glance

CVE Identifier CVE-2024-43379
GHSA Identifier GHSA-3r74-v83p-f4f4
Severity LOW
CVSS v3.1 Base Score 3.4
CWE Classification CWE-918: Server-Side Request Forgery (SSRF)
Affected Product Github.com/trufflesecurity/trufflehog/v3
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 3.4

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality None (C:N)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2024-43379

To remediate this vulnerability, upgrade all affected Github.com/trufflesecurity/trufflehog/v3 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/trufflesecurity/trufflehog/v3 fixed: 3.81.9 
Upgrade github.com/trufflesecurity/trufflehog/v3 to 3.81.9
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/trufflesecurity/trufflehog/v3

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-43379, inspect your project dependencies for Github.com/trufflesecurity/trufflehog/v3:

inspect dependencies for github.com/trufflesecurity/trufflehog/v3

Analyze the terminal output to locate any version of Github.com/trufflesecurity/trufflehog/v3 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.81.9), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-918: Server-Side Request Forgery (SSRF), where the web server receives a url or similar request from an upstream component and retrieves the contents of this url, but it does not sufficiently ensure that the request is being sent to the expected destination. In Github.com/trufflesecurity/trufflehog/v3, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact _What kind of vulnerability is it? Who is impacted?_ This vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, the target endpoint must be an unauthenticated GET endpoint that produces side effects. The victim must scan the maliciously crafted data and have such an endpoint targeted for the exploit to succeed. ### Patches _Has the problem been patched? What versions should users upgrade to?_ The vulnerability has been resolved in TruffleHog v3.81.9 and later versions. Users should upgrade to this or a more recent version to mitigate the issue. _Special thanks to Karan Bamal, Security Researcher at Sentinel One for this discovery_

CVE-2024-43379 Affected Github.com/trufflesecurity/trufflehog/v3 Versions

1 component(s)
Fixed Versions:
3.81.9
Product / Package Ecosystem Affected Versions Fixed Version
github.com/trufflesecurity/trufflehog/v3
golang/github.com/trufflesecurity/trufflehog/v3
Go
< 3.81.9
3.81.9

References

GitHub Advisory / Wiki ADVISORY
https://github.com/trufflesecurity/trufflehog/security/advisories/GHSA-3r74-v83p-f4f4
NVD — CVE-2024-43379 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-43379
Security Fix Commit FIX COMMIT
https://github.com/trufflesecurity/trufflehog/commit/fe5624c70923355128868cffd647b6e2cfe11443
Github.com/trufflesecurity/trufflehog/v3 Source Repository REPOSITORY
https://github.com/trufflesecurity/trufflehog

Frequently Asked Questions

What is CVE-2024-43379?
CVE-2024-43379 is a security vulnerability in Github.com/trufflesecurity/trufflehog/v3 involving Trufflehog vulnerable to Blind SSRF in some Detectors under CWE-918: Server-Side Request Forgery (SSRF).
Which Github.com/trufflesecurity/trufflehog/v3 versions are affected?
Affected versions include releases prior to 3.81.9 across affected packages: github.com/trufflesecurity/trufflehog/v3.
What version fixes CVE-2024-43379?
Upgrading to 3.81.9 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/trufflesecurity/trufflehog/v3 affected?
Yes, github.com/trufflesecurity/trufflehog/v3 is affected in releases prior to 3.81.9. Upgrade your dependency to 3.81.9 or later.
What is the CVSS score of CVE-2024-43379?
CVE-2024-43379 has a CVSS v3.1 base score of 3.4 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N.
What CWE is associated with CVE-2024-43379?
CVE-2024-43379 is classified under CWE-918: Server-Side Request Forgery (SSRF) (The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.).
How can I check Go dependencies for CVE-2024-43379?
Run the dependency tree command: 'inspect dependencies for github.com/trufflesecurity/trufflehog/v3'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3r74-v83p-f4f4",
  "modified" : "2024-08-19T17:29:25Z",
  "published" : "2024-08-19T17:29:25Z",
  "aliases" : [ "CVE-2024-43379" ],
  "summary" : "Trufflehog vulnerable to Blind SSRF in some Detectors",
  "details" : "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThis vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, the target endpoint must be an unauthenticated GET endpoint that produces side effects. The victim must scan the maliciously crafted data and have such an endpoint targeted for the exploit to succeed.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThe vulnerability has been resolved in TruffleHog v3.81.9 and later versions. Users should upgrade to this or a more recent version to mitigate the issue.\n\n_Special thanks to Karan Bamal, Security Researcher at Sentinel One for this discovery_",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/trufflesecurity/trufflehog/v3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.81.9"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/trufflesecurity/trufflehog/security/advisories/GHSA-3r74-v83p-f4f4"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-43379"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/trufflesecurity/trufflehog/commit/fe5624c70923355128868cffd647b6e2cfe11443"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/trufflesecurity/trufflehog"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-918" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-08-19T17:29:25Z",
    "nvd_published_at" : "2024-08-19T15:15:08Z"
  }
}