CVE-2022-1592 (Python, published 2022-05-05T11:15Z)
Description: value: Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requests to fishing steal cookie, request to private area, or lead to xss...
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/clinical-genomics/scout
Files changed:
CHANGELOG.md
scout/server/blueprints/alignviewers/controllers.py
scout/server/blueprints/alignviewers/views.py
tests/server/blueprints/alignviewers/test_alignviewers_views.py
Commit message: Protect remote_cors from Server-Side Request Forgery (#3326)

* Protect remote_cors from Server-Side Request Forgery

* Improved code and added test

* Fix a couple of comments in a test

Vulnerable code:
        if key not in ["tracks", "custom_tracks", "sample_tracks"]:
    if current_user.is_authenticated is False or file_path not in session.get("igv_tracks", []):
        LOG.warning(f"{file_path} not in {session.get('igv_tracks', [])}")
            # GIVEN that resource file exists in user session
def test_remote_cors(app):
    cloud_track_url = "http://google.com"
    # GIVEN an initialized app
    # GIVEN a valid user and institute
        assert resp.status_code == 200
        # THEN it should return success response

Fixed code:
- Protect remote_cors function in alignviewers view from Server-Side Request Forgery (SSRF)
def check_session_tracks(resource):
    """Make sure that a user requesting a resource is authenticated and resource is in session IGV tracks

    Args:
        resource(str): a resource on the server or on a remote URL

    Returns
        True is user has access to resource else False
    """
    # Check that user is logged in or that file extension is valid
    if current_user.is_authenticated is False:
        LOG.warning("Unauthenticated user requesting resource via remote_static")
        return False
    if resource not in session.get("igv_tracks", []):
        LOG.warning(f"{resource} not in {session.get('igv_tracks', [])}")
        return False
    return True


        if key not in ["tracks", "custom_tracks", "sample_tracks", "cloud_public_tracks"]:
    # Check that user is logged in or that file extension is valid
    if controllers.check_session_tracks(remote_url) is False:
        return abort(403)

    if controllers.check_session_tracks(file_path) is False:

        # GIVEN that resource file exists in user session
def test_remote_cors_wrong_resource(app):
    # GIVEN a resource not present in session["igv_tracks"]
    an_url = "http://google.com"
    # GIVEN a running demo app
        resp = client.get(url_for("alignviewers.remote_cors", remote_url=an_url))

        # THEN it should return forbidden (403)
        assert resp.status_code == 403


def test_remote_cors(app):
    """Test endpoint that serves as a proxy to the actual remote track on the cloud"""
    # GIVEN an igv track on the cloud
    cloud_track_url = "https://s3-eu-west-1.amazonaws.com/pfigshare-u-files/25777460/GRCh37.variant_call.clinical.pathogenic_or_likely_pathogenic.vcf.gz.tbi"

    # GIVEN a running demo app
    with app.test_client() as client:
        # GIVEN that the user could be logged in
        resp = client.get(url_for("auto_login"))

        # GIVEN that resource url exists in user session
        with client.session_transaction() as session:
            session["igv_tracks"] = [cloud_track_url]

        # WHEN the remote cors endpoint is invoked with cloud_track_url

        # THEN response should be successful