CVE-2023-24243
Published: 16 June 2023
Summary
CVE-2023-24243 is a high-severity SSRF (CWE-918) vulnerability in Cdata Arc. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CData RSB Connect version 22.0.8336 contains a server-side request forgery vulnerability tracked as CVE-2023-24243. The flaw is classified under CWE-918 and carries a CVSS 3.1 base score of 7.5, reflecting network attack vector, low complexity, and no required authentication or user interaction, resulting in high impact to confidentiality with unchanged scope.
An unauthenticated remote attacker can supply crafted requests that cause the affected server to issue arbitrary outbound requests, potentially disclosing sensitive internal resources or services reachable from the host. The high EPSS score of 0.9037 indicates substantial exploitation likelihood.
Public references include a CData knowledge-base notice and a technical disclosure on GitHub that point to the vendor site for further information, though specific patch or configuration guidance is not detailed in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28301
Vulnerability details
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.
Validates server-side URLs and resource references to block SSRF attempts.
Detects server-side request forgery through monitoring of unexpected outbound connections.