CyberRota Analysis
AI-GeneratedThe oras-go library, prior to version 2.6.1, is vulnerable to server-side request forgery (SSRF) due to improper validation of the realm URL from a registry's authentication challenge. This flaw allows attackers to potentially access internal networks or downgrade secure connections, which could lead to unauthorized data exposure or manipulation. Organizations using this library should prioritize updating to version 2.6.1 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.