CVE-2023-27159
📋 TL;DR
Appwrite versions up to 1.2.1 contain a Server-Side Request Forgery (SSRF) vulnerability in the /v1/avatars/favicon endpoint. Attackers can send crafted GET requests to make the server access internal network resources and potentially retrieve sensitive information. All Appwrite deployments running vulnerable versions are affected.
💻 Affected Systems
- Appwrite
📦 What is this software?
Appwrite by Appwrite
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, cloud metadata endpoints, or sensitive data stores, potentially leading to full network compromise or data exfiltration.
Likely Case
Attackers scan internal networks, access metadata services (like AWS/Azure instance metadata), or retrieve files from internal web servers.
If Mitigated
With proper network segmentation and egress filtering, impact is limited to accessing only allowed internal resources.
🎯 Exploit Status
Public proof-of-concept code exists in GitHub gists. Exploitation requires only HTTP GET requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.2.2 and later
Vendor Advisory: https://github.com/appwrite/appwrite
Restart Required: Yes
Instructions:
1. Update Appwrite to version 1.2.2 or later. 2. Restart the Appwrite service. 3. Verify the fix by testing the /v1/avatars/favicon endpoint.
🔧 Temporary Workarounds
Block vulnerable endpoint
allUse web application firewall or reverse proxy to block requests to /v1/avatars/favicon
# Example nginx location block
location /v1/avatars/favicon { deny all; }
Network egress filtering
linuxRestrict outbound connections from Appwrite server to only necessary destinations
# Example iptables rule
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Appwrite from sensitive internal resources
- Deploy web application firewall with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Send a GET request to /v1/avatars/favicon with a URL parameter pointing to an internal resource and check if it's accessed.Check Version:
docker exec appwrite appwrite versionVerify Fix Applied:
After patching, attempt the same SSRF test - it should fail or return an error.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Appwrite server
- Requests to /v1/avatars/favicon with URL parameters
Network Indicators:
- Appwrite server making unexpected HTTP requests to internal IP addresses
SIEM Query:
source="appwrite.logs" AND uri="/v1/avatars/favicon" AND url=*🔗 References
- http://appwrite.com
- https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a
- https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb
- https://github.com/appwrite/appwrite
- https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA
- http://appwrite.com
- https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a
- https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb
- https://github.com/appwrite/appwrite
- https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA
