CyberRota Analysis
AI-GeneratedAuthenticated users with Lighthouse provider configuration access in Prowler versions prior to 5.33.1 can exploit an unvalidated base_url vulnerability, potentially leading to unauthorized outbound requests that expose sensitive API keys in the Authorization header. This high-severity flaw poses significant risks to organizations using Prowler for cloud security, particularly those with misconfigured access controls. It is crucial for all users of affected versions to prioritize upgrading to version 5.33.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouse_providers.py to send outbound requests, including the API key in the Authorization header, to attacker-controlled or internal endpoints when client.models.list was called. This issue is fixed in version 5.33.1.