Executive Summary

This vulnerability exists in Arcane, an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.17.3, the /api/templates/fetch endpoint accepts a URL parameter from the caller and performs a server-side HTTP GET request to that URL without any authentication or validation of the URL's scheme or host.

Because the server returns the response directly to the caller, this creates an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. This means an attacker can make the server send HTTP requests to arbitrary URLs, potentially accessing internal or protected resources.

Useful 0 Not Useful 0

Impact Analysis

This SSRF vulnerability can allow an attacker to make the vulnerable Arcane server send HTTP requests to internal or external systems without authentication.

The impact includes potential unauthorized access to internal services, exposure of sensitive information, and possible manipulation of internal network resources.

The CVSS score of 7.2 indicates a high severity with low attack complexity, no privileges required, and no user interaction needed, making exploitation relatively easy and impactful.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Arcane to version 1.17.3 or later, where the SSRF issue in the /api/templates/fetch endpoint has been fixed.

Useful 0 Not Useful 0