Design/Logic Flaw

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL...

CVE-2022-36048

CVE-2022-36048 concerns Zulip Server prior to 5.6, where an attacker who can send messages can craft image-URLs to bypass the go-camo image proxy and cause the viewer’s IP address and browser fingerprinting information to be inferred via embedded remote images. The vulnerability affects Zulip Ser...