CVE-2021-25939 ArangoDB - Blind SSRF when Downloading Foxx Service from URL

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...

CVE-2021-25939

In ArangoDB, versions 3.7.0 through 3.9.0-alpha.1 allow downloading a Foxx service from a publicly available URL without proper internal request filtering, enabling a highly-privileged attacker to perform blind SSRF and reach localhost. Public documents confirm the root cause as inadequate filter...

CVE-2021-25939

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and...