CVE-2017-6201

HIGH 8.1CVE-2017-6201 · Published 06/02/2018 · updated 17/06/2026

In short

CVE-2017-6201 is a HIGH (CVSS 8.1) vulnerability affecting sandstorm (sandstorm).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.2% of all vulnerabilities.
Fix: update to 0.203 or later.

Package	Affected versions	Patched versions
sandstorm sandstorm	`< 0.203`	`0.203`

Description

A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote attacker may exploit this issue by providing a URL. It could bypass access control such as firewalls that prevent the attackers from accessing the URLs directly.

References

devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en · Exploit
sandstorm-io/sandstorm commit 164997f · Patch
sandstorm.io/news/2017-03-02-security-review · Vendor Advisory

More vulnerabilities in sandstorm

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free