CVE-2024-43371

CKAN is an open-source data management system for powering data hubs and data portals. There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming contents or saving a local copy). All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it (known as a Server Side Request Forgery). Users wanting to protect against these kinds of attacks can use one or a combination of the following approaches: (1) Use a separate HTTP proxy like Squid that can be used to allow / disallow IPs, domains etc as needed, and make CKAN extensions aware of this setting via the ckan.download_proxy config option. (2) Implement custom firewall rules to prevent access to restricted resources. (3) Use custom validators on the resource url field to block/allow certain domains or IPs. All latest versions of the plugins listed above support the ckan.download_proxy settings. Support for this setting in the Resource Proxy plugin was included in CKAN 2.10.5 and 2.11.0.

• CWE-918
• CWE-918

• https://github.com/ckan/ckan/security/advisories/GHSA-g9ph-j5vj-f8wmVendor Advisory

Published

Aug 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43366zkvyper is a Vyper compiler. Starting in version 1.3.12 and …9.1
• CVE-2024-43367Boa is an embeddable and experimental Javascript engine writ…7.5
• CVE-2024-43368The Trix editor, versions prior to 2.1.4, is vulnerable to X…6.5
• CVE-2024-43369Ibexa RichText Field Type is a Field Type for supporting ric…7.2
• CVE-2024-4337Adive Framework 2.0.8, does not sufficiently encode user-con…7.4
• CVE-2024-43370gettext.js is a GNU gettext port for node and the browser. T…7.2
• CVE-2024-43372Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-43373webcrack is a tool for reverse engineering javascript. An ar…7.8
• CVE-2024-43374The UNIX editor Vim prior to version 9.1.0678 has a use-afte…4.7
• CVE-2024-43376Umbraco is an ASP.NET CMS. Some endpoints in the Management …5.3
• CVE-2024-43377Umbraco CMS is an ASP.NET CMS. An authenticated user can acc…4.3
• CVE-2024-43378calamares-nixos-extensions provides Calamares branding and m…7.8