TruffleHog has a Blind SSRF in some Detectors
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
TruffleHog is a secrets scanning tool. Prior to v3.81.9, this vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective, the target endpoint must be an unauthenticated GET endpoint that produces side effects. The victim must scan the maliciously crafted data and have such an endpoint targeted for the exploit to succeed. The vulnerability has been resolved in TruffleHog v3.81.9 and later versions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Truffle Security Co. | trufflehog | before 3.81.9 | 3.81.9 | Patch available | CNA |
| — | github.com/trufflesecurity/trufflehog/v3 (Go) | before 3.81.9 | 3.81.9 | Patch available | GHSA-3r74-v83p-f4f4 |
- trufflehog VendorTruffle Security Co. Affected before 3.81.9 Fixed in 3.81.9 Patch available CNA
- github.com/trufflesecurity/trufflehog/v3 (Go) Vendor— Affected before 3.81.9 Fixed in 3.81.9 Patch available GHSA-3r74-v83p-f4f4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:trufflesecurity:trufflehog:*:*:*:*:*:*:*:* | before 3.81.9 | Vulnerable | Truffle Security Co. |
- cpe:2.3:a:trufflesecurity:trufflehog:*:*:*:*:*:*:*:* Versions before 3.81.9 Vulnerable ·Truffle Security Co.
Remediation
- Fix · CNA trufflehog (trufflesecurity) Fixed in 3.81.9
- Fix · GHSA-3r74-v83p-f4f4 github.com/trufflesecurity/trufflehog/v3 (Go) Fixed in 3.81.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-43379
- 2026-10-03 Alias added: GHSA-3r74-v83p-f4f4
References
Sources
- CVE-2024-43379 · CVE Program
- CVE-2024-43379 · NVD
- FIRST EPSS
- GHSA-3r74-v83p-f4f4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences