What’s Vulnerable › Vulnerabilities

CVE-2017-6201

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-02-06 · updated 2026-06-17
• Weakness: CWE-918

Description

A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote attacker may exploit this issue by providing a URL. It could bypass access control such as firewalls that prevent the attackers from accessing the URLs directly.

Affected products

• Sandstorm: before 0.203 — fixed in 0.203

How to fix

Upgrade to a fixed version: Sandstorm 0.203. Check the vendor advisory for mitigations.

References

• https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/
• https://github.com/sandstorm-io/sandstorm/commit/164997fb958effbc90c5328c166706280a84aaa1
• https://sandstorm.io/news/2017-03-02-security-review
• https://devco.re/blog/2018/01/26/Sandstorm-Security-Review-CVE-2017-6200-en/
• https://github.com/sandstorm-io/sandstorm/commit/164997fb958effbc90c5328c166706280a84aaa1
• https://sandstorm.io/news/2017-03-02-security-review

Get alerted when CVE-2017-6201 or the next vulnerability affects your stack