conductor-oss conductor PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery

Overview

A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Task Handler. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project.

Affected

• conductor 3.0
• conductor 3.1
• conductor 3.2
• conductor 3.3
• conductor 3.4
• conductor 3.5
• conductor 3.6
• conductor 3.7
• conductor 3.8
• conductor 3.9
• conductor 3.10
• conductor 3.11
• conductor 3.12
• conductor 3.13
• conductor 3.14
• conductor 3.15
• conductor 3.16
• conductor 3.17
• conductor 3.18
• conductor 3.19
• conductor 3.20
• conductor 3.21
• conductor 3.22
• conductor 3.23
• conductor 3.24
• conductor 3.25
• conductor 3.26
• conductor 3.27
• conductor 3.28
• conductor 3.29
• conductor 3.30
• conductor 3.31
• conductor 3.32
• conductor 3.32.0
• conductor 3.32.1
• conductor 3.32.2
• conductor 3.32.3
• conductor 3.32.4
• conductor 3.33.0
• conductor 3.34.0-rc1
• conductor 3.34.0-rc2
• conductor 3.34.0-rc3
• conductor 4.0.0-alpha.0
• conductor 4.0.0-alpha.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.