CVE-2024-23838
📋 TL;DR
This vulnerability in TrueLayer.NET SDK allows attackers to manipulate HttpClient destination URLs, potentially redirecting API requests to malicious servers. Applications using vulnerable versions of the SDK could have their requests sent to unexpected resources, leading to information disclosure. Only versions before v1.6.0 are affected.
💻 Affected Systems
- TrueLayer.NET SDK (truelayer-dotnet)
📦 What is this software?
Truelayer.net by Truelayer
⚠️ Risk & Real-World Impact
Worst Case
Complete information disclosure of sensitive API data, potential credential theft, and unauthorized access to internal network resources via SSRF.
Likely Case
Information leakage of API responses to attacker-controlled servers, potentially exposing user data or financial information.
If Mitigated
Limited impact with proper input validation and network egress controls, potentially no successful exploitation.
🎯 Exploit Status
Exploitation requires control over user input passed to the SDK. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.6.0
Vendor Advisory: https://github.com/TrueLayer/truelayer-dotnet/security/advisories/GHSA-67m4-qxp3-j6hh
Restart Required: No
Instructions:
1. Update TrueLayer.Client NuGet package to v1.6.0 or later. 2. Run 'dotnet restore' to fetch updated packages. 3. Rebuild and redeploy your application.
🔧 Temporary Workarounds
Implement strict input validation
allValidate and sanitize all user input before passing it to TrueLayer SDK methods
Network egress restrictions
allImplement firewall rules to restrict outbound connections from application servers to only authorized TrueLayer API endpoints
🧯 If You Can't Patch
- Implement strict input validation on all user inputs passed to TrueLayer SDK
- Deploy network egress controls to restrict outbound connections to only authorized TrueLayer endpoints
🔍 How to Verify
Check if Vulnerable:
Check the TrueLayer.Client package version in your project's .csproj file or NuGet package manager. Versions below 1.6.0 are vulnerable.Check Version:
dotnet list package | findstr TrueLayer.ClientVerify Fix Applied:
Verify the installed TrueLayer.Client package version is 1.6.0 or higher using 'dotnet list package' or checking the .csproj file.📡 Detection & Monitoring
Log Indicators:
- Unexpected outbound HTTP requests from application
- Requests to non-TrueLayer domains from TrueLayer SDK
- HTTP errors from unexpected destinations
Network Indicators:
- Outbound HTTP requests to unexpected IP addresses or domains
- Requests to internal network resources from application servers
SIEM Query:
source="application_logs" AND ("TrueLayer" OR "truelayer-dotnet") AND (destination_ip NOT IN ["52.16.0.0/14", "52.222.0.0/16"])🔗 References
- https://github.com/TrueLayer/truelayer-dotnet/commit/75e436ed5360faa73d6e7ce3a9903a3c49505e3e
- https://github.com/TrueLayer/truelayer-dotnet/security/advisories/GHSA-67m4-qxp3-j6hh
- https://github.com/TrueLayer/truelayer-dotnet/commit/75e436ed5360faa73d6e7ce3a9903a3c49505e3e
- https://github.com/TrueLayer/truelayer-dotnet/security/advisories/GHSA-67m4-qxp3-j6hh
