CVE-2023-41327 json
Controlled SSRF through URL in the WireMock
published 2023-09-06 3 y ago modified 2026-09-08 2 mo ago also BIT-wiremock-2023-41327 , EUVD-2023-2527 , GHSA-hq8w-9w8w-pmx7
- cvss
- 4.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
WireMock is a tool for mocking HTTP services. WireMock can be configured to only permit proxying (and therefore recording) to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first.
Until WireMock Webhooks Extension 3.0.0-beta-15, the filtering of target addresses from the proxy mode DID NOT work for Webhooks, so the users were potentially vulnerable regardless of the `limitProxyTargets` settings. Via the WireMock webhooks configuration, POST requests from a webhook might be forwarded to an arbitrary service reachable from WireMock’s instance. For example, If someone is running the WireMock docker Container inside a private cluster, they can trigger internal POST requests against unsecured APIs or even against secure ones by passing a token, discovered using another exploit, via authentication headers. This issue has been addressed in versions 2.35.1 and 3.0.3 of wiremock. Wiremock studio has been discontinued and will not see a fix. Users unable to upgrade should use external firewall rules to define the list of permitted destinations.
Patch / fix
- maven org.wiremock:wiremock-webhooks-extension 2.35.1, 3.0.3
- bitnami wiremock 2.35.1, 3.0.3
- wiremock wiremock 2.35.1, 3.0.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.6 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
| GitHub | 3.1 | 4.6 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.wiremock:wiremock-webhooks-extension | >=3.0.0, <3.0.3 >=2.0.0, <2.35.1 |
3.0.3 2.35.1 |
| bitnami | wiremock | >=2.0.0, <2.35.1 >=3.0.0, <3.0.3 |
2.35.1 3.0.3 |
Affected products
- wiremock wiremock
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
wiremock.org
/docs/configuration/#preventing-proxying-to-and-recording-from-specific-target-addresses
web, patch
-
github.com
/wiremock/wiremock/security/advisories/GHSA-hq8w-9w8w-pmx7
web, vendor-advisory, advisory
-
github.com
/wiremock/wiremock/releases/tag/3.0.0-beta-15
web, release-notes, article
-
nvd.nist.gov
/vuln/detail/CVE-2023-41327
advisory, web
-
github.com
/wiremock/wiremock
package
-
github.com
/wiremock/wiremock/releases/tag/2.35.1
web
-
github.com
/wiremock/wiremock/releases/tag/3.0.3
web
Sources
- CVE List CVE-2023-41327
- GitHub Advisory GHSA-hq8w-9w8w-pmx7
- NVD CVE-2023-41327
- OSV BIT-wiremock-2023-41327
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.