CVE-2022-27311 (published 2022-04-25T13:15Z)

Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/amro/gibbon
commit_details: repo_url: https://github.com/amro/gibbon
author: Guillaume Feliciano
author_date: 2022-02-18 10:59:38+00:00
msg: Ensure we raise if the root domain changed and it was not an expected behavior
repository: repo_url: https://github.com/amro/gibbon
repo_name: amro/gibbon
description: Gibbon is an API wrapper for MailChimp's API
repo_language: Ruby
owner: amro
file_changes: filename: api_request.rb
change_type: ModificationType.MODIFY
diff: @@ -194,6 +194,8 @@ module Gibbon
 
     def base_api_url
       computed_api_endpoint = "https://#{get_data_center_from_api_key(self.api_key)}api.mailchimp.com"
+      raise Gibbon::GibbonError, "SSRF attempt" unless URI(computed_api_endpoint).host.include?("api.mailchimp.com")
+
       "#{self.api_endpoint || computed_api_endpoint}/3.0/"
     end
   end

programming_language: Ruby
filename: gibbon_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -162,6 +162,12 @@ describe Gibbon do
       @request = Gibbon::APIRequest.new(builder: @gibbon)
       expect {@request.validate_api_key}.not_to raise_error
     end
+
+    it "raises with a valid SSRF attack" do
+      @api_key = "-attacker.net/test/?"
+      @gibbon.api_key = @api_key
+      expect {@gibbon.try.retrieve}.not_to raise_error
+    end
   end
 
   describe "class variables" do
@@ -213,7 +219,7 @@ describe Gibbon do
     it "set debug on new instances" do
       expect(Gibbon::Request.new.debug).to eq(Gibbon::Request.debug)
     end
-    
+
     it "set faraday_adapter on new instances" do
       expect(Gibbon::Request.new.faraday_adapter).to eq(Gibbon::Request.faraday_adapter)
     end

programming_language: Ruby
repo_url: https://github.com/amro/gibbon
commit_details: repo_url: https://github.com/amro/gibbon
author: Amro Mousa
author_date: 2022-02-24 16:10:06-05:00
msg: bump version, handle invalid API key DC
repository: repo_url: https://github.com/amro/gibbon
repo_name: amro/gibbon
description: Gibbon is an API wrapper for MailChimp's API
repo_language: Ruby
owner: amro
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,7 @@
 ## [Unreleased][unreleased]
 
+## [3.4.4] - 2022-02-24
+- Remove non-alpha characters when parsing datacenter from API keys to prevent potential attackers from injecting a domain via the API key. This would only be possible if one were using user-provided API keys (e.g. from a form, etc.).
 
 ## [3.4.3] - 2022-01-19
 - Support for Faraday 2.0, which requires new syntax for basic auth

programming_language: Markdown
filename: api_request.rb
change_type: ModificationType.MODIFY
diff: @@ -194,8 +194,6 @@ module Gibbon
 
     def base_api_url
       computed_api_endpoint = "https://#{get_data_center_from_api_key(self.api_key)}api.mailchimp.com"
-      raise Gibbon::GibbonError, "SSRF attempt" unless URI(computed_api_endpoint).host.include?("api.mailchimp.com")
-
       "#{self.api_endpoint || computed_api_endpoint}/3.0/"
     end
   end

programming_language: Ruby
filename: gibbon_helpers.rb
change_type: ModificationType.MODIFY
diff: @@ -5,8 +5,12 @@ module Gibbon
       data_center = ""
 
       if api_key && api_key["-"]
-        # Add a period since the data_center is a subdomain and it keeps things dry
-        data_center = "#{api_key.split('-').last}."
+        # Remove all non-alphanumberic characters in case someone attempts to inject
+        # a different domain into the API key (e.g. when consuming user form-provided keys)
+        # This approach avoids assuming a 3 letter prefix (e.g. is MC were to create 
+        # a us10 DC, this would continue to work), and will continue to hit MC's server
+        # rather than a would-be attacker's servers.
+        data_center = "#{api_key.split('-').last.gsub(/[^0-9a-z ]/i, '')}."
       end
 
       data_center

programming_language: Ruby
filename: version.rb
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,3 @@
 module Gibbon
-  VERSION = "3.4.3"
+  VERSION = "3.4.4"
 end

programming_language: Ruby
filename: gibbon_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -14,6 +14,7 @@ describe Gibbon do
       @gibbon = Gibbon::Request.new
       expect(@gibbon.api_key).to be_nil
     end
+  
     it "sets an API key in the constructor" do
       @gibbon = Gibbon::Request.new(api_key: @api_key)
       expect(@gibbon.api_key).to eq(@api_key)
@@ -163,10 +164,12 @@ describe Gibbon do
       expect {@request.validate_api_key}.not_to raise_error
     end
 
-    it "raises with a valid SSRF attack" do
-      @api_key = "-attacker.net/test/?"
+    it "removes non-alpha characters from datacenter prefix" do
+      @api_key = "123-attacker.net/test/?"
       @gibbon.api_key = @api_key
-      expect {@gibbon.try.retrieve}.to raise_error(Gibbon::MailChimpError, /SSRF attempt/)
+      @gibbon.try
+      @request = Gibbon::APIRequest.new(builder: @gibbon)
+      expect(@request.api_url).to eq("https://attackernettest.api.mailchimp.com/3.0/try")
     end
   end
 

programming_language: Ruby