CVE-2022-31196: Server-Side Request Forgery (SSRF) (CWE-918)
value: Databasir is a database metadata management platform. Databasir <= 1.06 has Server-Side Request Forgery (SSRF) vulnerability. The SSRF is triggered by a sending a **single** HTTP POST request to create a databaseType. By supplying a `jdbcDriverFileUrl` that returns a non `200` response code, the url is executed, the response is logged (both in terminal and in database) and is included in the response. This would allow an attackers to obtain the real IP address and scan Intranet information. This issue was fixed in version 1.0.7.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.5
Published: 2022-09-02T20:15Z
Repository: https://github.com/vran-dev/databasir
Language: Java
Files changed: core/src/main/java/com/databasir/core/infrastructure/driver/DriverResources.java
Commit date: 2022-07-29 11:18:51 +0800
Commit message: fix: security vulnerability SSRF (#256)


Diff: diff --git a/core/src/main/java/com/databasir/core/infrastructure/driver/DriverResources.java b/core/src/main/java/com/databasir/core/infrastructure/driver/DriverResources.java
index a15ae02..672cf06 100644
--- a/core/src/main/java/com/databasir/core/infrastructure/driver/DriverResources.java
+++ b/core/src/main/java/com/databasir/core/infrastructure/driver/DriverResources.java
@@ -58,11 +58,11 @@ public class DriverResources {
     private File download(String driverFileUrl, String parentDir) {
         Path parentDirPath = Paths.get(parentDir);
         try {
             Files.createDirectories(parentDirPath);
         } catch (IOException e) {
-            log.error("下载驱动时创建目录失败", e);
+            log.error("create directory for driver failed", e);
             throw DomainErrors.DOWNLOAD_DRIVER_ERROR.exception(e);
         }
 
         // download
         try {
@@ -95,12 +95,13 @@ public class DriverResources {
                             + ", "
                             + response.getStatusText());
                 }
             });
         } catch (RestClientException e) {
-            log.error(parentDir + " download driver error", e);
-            throw DomainErrors.DOWNLOAD_DRIVER_ERROR.exception(e.getMessage());
+            String msg = String.format("download driver from %s to %s failed", driverFileUrl, parentDir);
+            log.error(msg, e);
+            throw DomainErrors.DOWNLOAD_DRIVER_ERROR.exception(msg);
         }
     }
 
     public void deleteByDatabaseType(String databaseType) {
         String baseDir = driverBaseDirectory + "/" + databaseType;

Vulnerable code:             log.error("下载驱动时创建目录失败", e);
            log.error(parentDir + " download driver error", e);
            throw DomainErrors.DOWNLOAD_DRIVER_ERROR.exception(e.getMessage());
Fixed code:             log.error("create directory for driver failed", e);
            String msg = String.format("download driver from %s to %s failed", driverFileUrl, parentDir);
            log.error(msg, e);
            throw DomainErrors.DOWNLOAD_DRIVER_ERROR.exception(msg);