Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-24710

CVE-2020-24710: Gophish vulnerable to Server-Side Request Forgery

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-24710
GHSA ID
GHSA-9c9w-9pq7-f35h
EPSS Score
0.52773%
CWE
CWE-918
Published
5/24/2022
Updated
7/29/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/gophish/gophishgo< 0.11.00.11.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from unrestricted outbound network connections in multiple components. The commit adds a RestrictedDialer to three critical paths: 1) Website import functionality (controllers/api/import.go) which made arbitrary HTTP requests, 2) IMAP client connections (imap/imap.go), and 3) SMTP dialer setup (models/smtp.go). These functions previously used Go's default network dialer without IP validation, allowing access to internal endpoints like cloud metadata services (169.254.169.254). The vulnerability is confirmed by the patch patterns, CVE description, and Herolab's advisory showing these components were used for internal network probing.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*op*is* ***or* *.**.* *llows SSR* *tt**ks.

Reasoning

T** vuln*r**ility st*mm** *rom unr*stri*t** out*oun* n*twork *onn**tions in multipl* *ompon*nts. T** *ommit ***s * R*stri*t***i*l*r to t*r** *riti**l p*t*s: *) W**sit* import *un*tion*lity (*ontroll*rs/*pi/import.*o) w*i** m*** *r*itr*ry *TTP r*qu*st