Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-jxpm-75mh-9fp7, is a Server-Side Request Forgery (SSRF) vulnerability in the oras-go library. The flaw exists in the blob upload process. When a client uploads a blob, it sends an initial POST request. The registry can respond with a Location header, directing the client where to send the actual blob data via a PUT request. The vulnerability is that the oras-go client did not validate the Location header's host. A malicious registry could provide a URL to an attacker-controlled server in this header. The client would then proceed to make a PUT request to the attacker's server, forwarding the original Authorization header, thus leaking credentials.
The patch rectifies this by introducing a validation step within the (*blobStore).completePushAfterInitialPost function. It checks if the hostname in the Location header matches the hostname of the original request. If they differ, the operation is aborted, preventing the credential leak. The primary vulnerable function is (*blobStore).completePushAfterInitialPost because it's where the untrusted Location header is processed. The (*blobStore).Push function is also included as it is the entry point that leads to the execution of the vulnerable code path.
(*blobStore).completePushAfterInitialPostregistry/remote/repository.go
(*blobStore).Pushregistry/remote/repository.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| oras.land/oras-go/v2 | go | < 2.6.1 | 2.6.1 |