Take action: You need to maintain your open source tools as well as all others. Especially if they are exposing a service on the internet like Owncast.

---

Learn More

Security researchers have discovered two critical security vulnerabilities in two open-source platforms written in Go: Owncast and EaseProbe.

• CVE-2023-3188  (CVSS severity 8.3/10) - vulnerability in Owncast, an open-source, self-hosted, decentralized, single-user live video streaming and chat server written in Go. The vulnerability is labeled as an Unauthenticated Blind Server-Side Request Forgery (SSRF) and could potentially allow unauthenticated attackers to exploit the Owncast server by forcing the Owncast server to send HTTP requests to arbitrary locations using the GET HTTP method.
  • Security researchers recommend the following mitigation steps:
  • Prohibit the HTTP client utilized by Owncast from following HTTP redirections to mitigate the potential exploitation of SSRF attacks.
  • Implement restrictions to allow only authenticated users to trigger the vulnerable endpoint, thereby minimizing the risk of unauthorized access.
• CVE-2023-33967 (CVSS severity 9.8/10) vulnerability in EaseProbe, a lightweight and standalone health/status-checking tool written in Go. The vulnerabilities are categorized as Config-Based SQL-Injection and expose potential security risks for users of EaseProbe. Oxeye Security recommends immediate action to mitigate risk. The vulnerability can be exploited by attackers who control the EaseProbe configuration, enabling them to read, delete, or modify all information stored in the databases configured for health checking. In certain circumstances, depending on the user privileges and the database engine, the attacker may also execute arbitrary system commands on the server hosting the database. The vulnerable code is within the MySQL and Postgres database client code of EaseProbe.

  • Security researchers recommend the following mitigation step

  • Properly sanitize all user input to prevent SQL-injection vulnerabilities. This can be achieved by implementing techniques such as prepared statements and parameterized queries.

  • Ensure the application is regularly updated and patched. This problem has been fixed in EaseProbe v2.1.0.