Potential access to sensitive URLs via CKAN extensions (SSRF)
Impact
There are a number of CKAN plugins, including XLoader, DataPusher, Resource proxy and ckanext-archiver, that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming contents or saving a local copy). All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it (known as a Server Side Request Forgery).
Patches and Workarounds
Users wanting to protect against these kinds of attacks can use one or a combination of the following approaches:
- Use a separate HTTP proxy like Squid that can be used to allow / disallow IPs, domains etc as needed, and make CKAN extensions aware of this setting via the
ckan.download_proxyconfig option. - Implement custom firewall rules to prevent access to restricted resources.
- Use custom validators on the resource
urlfield to block/allow certain domains or IPs.
All latest versions of the plugins linked above support the ckan.download_proxy settings. Support for this setting in the Resource Proxy plugin was included in CKAN 2.10.5 and 2.11.0
References
- Blog post provides more details on how to configure a Squid proxy to prevent these issues
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | ckan | < 2.10.5 | 2.10.5 |
References
- https://github.com/ckan/ckan/security/advisories/GHSA-g9ph-j5vj-f8wm
- https://nvd.nist.gov/vuln/detail/CVE-2024-43371
- https://github.com/ckan/ckan/commit/382beaec98cb331f2a030459ef043c50eaf5ad53
- https://github.com/ckan/ckan/commit/8601183cc2fc87277ea5b33ff75c3a5610812ab5
- https://github.com/ckan/ckan
- https://pypi.org/project/ckan
- https://github.com/advisories/GHSA-g9ph-j5vj-f8wm
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-918- Platform
- Python (PyPI)
- Package
ckan- Disclosed
- 21.08.2024
- Updated
- 11.10.2026 13:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1252 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-g9ph-j5vj-f8wm - CC BY 4.0
Vulnerability history: ckan
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 15
- First → latest
- 12.2021 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 3
- Medium 11
Disclosures per year
- 2021: 1
- 2022: 1
- 2023: 2
- 2024: 4
- 2025: 3
- 2026: 4
-
Potential access to sensitive URLs via CKAN extensions (SSRF) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.