CVE-2021-29357 : Vulnerability Insights and Analysis

OutSystems Platform Server versions 10 before 10.0.1104.0 and 11 before 11.9.0, including LifeTime management console before 11.7.0, are vulnerable to Server-Side Request Forgery (SSRF) attacks. This allows adversaries to make arbitrary outbound HTTP requests.

Understanding CVE-2021-29357

This CVE involves a security flaw in the ECT Provider component of OutSystems Platform Server, impacting versions 10 and 11.

What is CVE-2021-29357?

The vulnerability in the ECT Provider component of OutSystems Platform Server versions allows attackers to conduct SSRF attacks for making unauthorized HTTP requests.

The Impact of CVE-2021-29357

The SSRF vulnerability can be exploited by malicious actors to bypass security controls and initiate unauthorized HTTP requests, potentially leading to data exfiltration or unauthorized access to internal systems.

Technical Details of CVE-2021-29357

The specifics of the vulnerability, affected systems, and exploitation mechanisms.

Vulnerability Description

OutSystems Platform Server versions 10 before 10.0.1104.0 and 11 before 11.9.0 are susceptible to SSRF attacks due to inadequate validation of user-controlled input affecting the ECT Provider component.

Affected Systems and Versions

The vulnerability impacts OutSystems Platform Server versions 10 and 11, along with LifeTime management console versions prior to 11.7.0.

Exploitation Mechanism

Adversaries can leverage the SSRF weakness in the ECT Provider component to trick the server into sending arbitrary HTTP requests on behalf of the attacker.

Mitigation and Prevention

Actions to mitigate the impact of CVE-2021-29357 and prevent future security incidents.

Immediate Steps to Take

Upgrade OutSystems Platform Server to version 10.0.1104.0 or 11.9.0, and LifeTime management console to version 11.7.0 to patch the vulnerability.

Long-Term Security Practices

Implement strict input validation mechanisms, conduct regular security assessments, and monitor outgoing HTTP requests for suspicious activities.

Patching and Updates

Stay informed about security updates for OutSystems Platform Server and apply patches promptly to address known vulnerabilities in a timely manner.