Harnessrouter
Monthly
Server-side request forgery in HarnessRouter's 'Targets Test Endpoint' (gateway/app.py) lets an authenticated caller holding a valid API key submit an arbitrary 'base_url' that the server fetches and whose response is returned to the caller, so affected deployments up to 0.31.12 can be induced to reach internal, loopback or cloud-metadata addresses (e.g., 169.254.169.254). The practical exposure is concentrated on shared/cloud deployments, since the vendor's fix deliberately keeps allowing internal http(s) destinations when the instance is self-hosted on the operator's own network. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has released v0.31.13 (commit 1c4b1fc1f89737dabd089ac1d1c174a57f764e28) as the fix.
Improper authorization in the HarnessRouter gateway through version 0.31.10 lets a request that carries the internal key plus a non-verifying bearer token assert arbitrary X-Harness-Org and X-Harness-Member identity headers, because the gateway's default identity mode was 'observe' rather than a fail-closed 'enforce'. This enables cross-tenant impersonation of any organization or member, with Low confidentiality, integrity, and availability impact; the attack is remote but rated high complexity and difficult to exploit, and no public exploit code or active exploitation has been identified at time of analysis. HarnessRouter 0.31.11 changes the default to 'enforce' and closes the issue.
Server-side request forgery in HarnessRouter's 'Targets Test Endpoint' (gateway/app.py) lets an authenticated caller holding a valid API key submit an arbitrary 'base_url' that the server fetches and whose response is returned to the caller, so affected deployments up to 0.31.12 can be induced to reach internal, loopback or cloud-metadata addresses (e.g., 169.254.169.254). The practical exposure is concentrated on shared/cloud deployments, since the vendor's fix deliberately keeps allowing internal http(s) destinations when the instance is self-hosted on the operator's own network. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has released v0.31.13 (commit 1c4b1fc1f89737dabd089ac1d1c174a57f764e28) as the fix.
Improper authorization in the HarnessRouter gateway through version 0.31.10 lets a request that carries the internal key plus a non-verifying bearer token assert arbitrary X-Harness-Org and X-Harness-Member identity headers, because the gateway's default identity mode was 'observe' rather than a fail-closed 'enforce'. This enables cross-tenant impersonation of any organization or member, with Low confidentiality, integrity, and availability impact; the attack is remote but rated high complexity and difficult to exploit, and no public exploit code or active exploitation has been identified at time of analysis. HarnessRouter 0.31.11 changes the default to 'enforce' and closes the issue.