GeoNode Server Side Request forgery
Summary
A server side request forgery vuln was found within geonode when testing on a bug bounty program. Server side request forgery allows a user to request information on the internal service/services.
Details
The endpoint /proxy/?url= does not properly protect against SSRF. when using the following format you can request internal hosts and display data. /proxy/?url=http://169.254.169.254@whitelistedIPhere. This will state wether the AWS internal IP is alive. If you get a 404, the host is alive. A non alive host will not display a response. To display metadata, use a hashfrag on the url /proxy/?url=http://169.254.169.254@#whitelisteddomain.com or try /proxy/?url=http://169.254.169.254@%23whitelisteddomain.com
Impact
Port scan internal hosts, and request information from internal hosts.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | geonode | >= 3.2.0, < 4.2.0 | 4.2.0 |
References
- https://github.com/GeoNode/geonode/security/advisories/GHSA-rmxg-6qqf-x8mr
- https://github.com/GeoNode/geonode/commit/a9eebae80cb362009660a1fd49e105e7cdb499b9
- https://nvd.nist.gov/vuln/detail/CVE-2023-40017
- https://github.com/GeoNode/geonode
- https://github.com/pypa/advisory-database/tree/main/vulns/geonode/PYSEC-2023-269.yaml
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-918- Platform
- Python (PyPI)
- Package
geonode- Disclosed
- 24.08.2023
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2023-269 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-rmxg-6qqf-x8mr - CC BY 4.0
Vulnerability history: geonode
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 02.2023 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 3
- Medium 3
Disclosures per year
- 2023: 3
- 2024: 1
- 2025: 0
- 2026: 2
-
GeoNode Server Side Request forgery this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.