W0Rty

WireMock is a tool for mocking HTTP services. When certain request URLs like "@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock's instance. There are 3 identified potential attack vectors: via "TestRequester" functionality, webhooks, and the proxy mode. As we can control HTTP Method, HTTP Headers, HTTP Data, it allows sending requests with the default level of credentials for the WireMock instance.

The issue is related to insufficient checking of incoming requests in WireMock, a tool for mocking HTTP services. This can allow a remote attacker to redirect POST requests to arbitrary services. The filtering of target addresses from the proxy mode did not work for Webhooks until WireMock Webhooks Extension 3.0.0-beta-15, making users potentially vulnerable regardless of the `limitProxyTargets` settings. Via the WireMock webhooks configuration, POST requests from a webhook might be forwarded to an arbitrary service reachable from WireMock’s instance.

The issue is related to the proxy mode of WireMock, which can be protected by network restrictions configuration. However, when these restrictions are configured using domain names, the configuration is vulnerable to DNS rebinding attacks. The root cause of the attack is a defect in the logic that allows for a race condition triggered by a DNS server whose address expires between the initial validation and the outbound network request. Control over a DNS service is required to exploit this attack, resulting in high execution complexity and limited impact.

O problema está relacionado à falta de sanitização adequada de links externos, o que pode ser explorado para um ataque de Cross-Site Scripting (XSS). Isso permite que um invasor remoto explore a vulnerabilidade.

O problema está relacionado ao uso de feeds RSS ou de um calendário externo no planejamento, o que está sujeito a uma exploração do tipo Server-Side Request Forgery (SSRF). Se um script remoto retornar uma resposta de redirecionamento, a URL de destino do redirecionamento não é verificada em relação à lista de URLs permitidas definida pelo administrador. Isso poderia permitir que um invasor remoto redirecionasse usuários para uma URL arbitrária.