Server Side Request Forgery (SSRF)

2024-07-0807:03:28

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

server side request forgery

internal ip addresses

http requests

fedify server's internal network

vulnerability

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

AI Score

Confidence

Low

JSON

@fedify/fedify is vulnerable to Server Side Request Forgery (SSRF). The vulnerability is caused by making HTTP requests to internal IP addresses referenced in received activities or media URLs, which allows an attacker to send requests to resources within the Fedify server’s internal network.