GitHub Advisoryadvisory · Go

GHSA-pw59-4qgf-jxr8 Cache Manipulation Attack in Apache Traffic Control

MEDIUM Published 2021-06-18 Modified 2022-04-04 Official page ↗
Aliases
CVE-2020-17522
Ecosystem
Go
Packages
github.com/apache/trafficcontrol
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weaknesses
CWE-525, CWE-732
Reviewed
2022-04-04

Affected packages

• Go github.com/apache/trafficcontrol: < 5.0.0 → fixed in 5.0.0

Description

When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN arcitechture.

Related

Alias · CVE (1)

  • CVE-2020-17522 When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files… vulnerability

Weakness · CWE (2)

  • CWE-525 Use of Web Browser Cache Containing Sensitive Information weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References