CVE-2019-7617

Elastic APM Python < 5.1.0 CGI script allows remote attacker to control proxy header and redirect data to chosen proxy

• CVSS 7.2
• CWE-20 Improper Input Validation
• Input Validation and Sanitization
• Remote

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.

CVE

CVE-2019-7617

CWE

CWE-20 Improper Input Validation

CVSS base score

7.2

Published

2019-08-22

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Elastic APM agent for Python to version 5.1.0 or higher.

import os
import json

def handle_apm_data():
    remote_addr = os.environ.get('REMOTE_ADDR')
    x_forwarded_for = os.environ.get('HTTP_X_FORWARDED_FOR')

    if x_forwarded_for:
        remote_addr = x_forwarded_for.split(',')[0]

    apm_data = json.loads(os.environ.get('CONTENT_LENGTH', ''))

    return "Data received from {}".format(remote_addr)

if __name__ == '__main__':
    print(handle_apm_data())

import os
from flask import Flask, request

app = Flask(__name__)

@app.route('/apm', methods=['POST'])
def apm_data():
    if 'X-Forwarded-For' in request.headers:
        app.logger.warning("Received X-Forwarded-For header: %s", request.headers['X-Forwarded-For'])
        
        trusted_proxies = ['192.0.2.1']
        if request.remote_addr not in trusted_proxies:
            return "Forbidden", 403

    apm_data = request.json

    return "Data received", 200

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve20197617,
  title        = {{Elastic APM Python < 5.1.0 CGI script allows remote attacker to control proxy header and redirect data to chosen proxy}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-7617},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-7617/}}
}