Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SSRF漏洞 #570

Open
cheng92hao opened this issue Jul 11, 2024 · 0 comments
Open

SSRF漏洞 #570

cheng92hao opened this issue Jul 11, 2024 · 0 comments

Comments

@cheng92hao
Copy link

Describe the bug:
1、登录处可以尝试链接系统环境可访问的数据库服务,并且没有访问次数限制和图片验证码校验,导致可以遍历访问地址address进行SSRF漏洞探测内部网络、数据库账号密码进行爆破弱密码等风险;
2、http://127.0.0.1:31018/api/v1/milvus/connect 接口处可以遍历address参数探测内部系统网络; 或者遍历username、password来尝试暴力破解系统账号密码;

修复建议:
1、此处建议增加图片验证码来校验链接操作,防范暴力破解遍历方式攻击;
2、建议校验address的地址范围,只允许链接特定的服务器;
3、此处账号密码建议加密后再传输。

Attu version:
2.4.0

Attu version:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant