CVE-2020-28360: Server-Side Request Forgery (SSRF)

November 23, 2020 (updated July 15, 2021)

RegEx in private-ip insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote attackers to request server-side resources or potentially execute arbitrary code through various SSRF techniques.

References

nvd.nist.gov/vuln/detail/CVE-2020-28360

Code Behaviors & Features

Detect and mitigate CVE-2020-28360 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →