| عنوان | AutohomeCorp frostmourne frostmourne <= 1.0 Server-Side Request Forgery |
|---|
| الوصف | Frostmourne contains a Server-Side Request Forgery (SSRF) vulnerability in the alarm preview functionality. The /alarm/previewData endpoint allows authenticated users to trigger arbitrary HTTP/HTTPS requests from the server without any URL validation and returns the HTTP response directly to the user, enabling attackers to access internal network resources, cloud metadata endpoints, and perform port scanning. |
|---|
| المصدر | ⚠️ https://fx4tqqfvdw4.feishu.cn/docx/GE4GdxBxKoSvBOxhkTRcsawlnhc?from=from_copylink |
|---|
| المستخدم | xcxr (UID 86629) |
|---|
| ارسال | 16/03/2026 07:25 AM (7 أشهر منذ) |
|---|
| الاعتدال | 31/03/2026 06:22 PM (15 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 354449 [AutohomeCorp frostmourne حتى 1.0 Alarm Preview AlarmController.java تجاوز الصلاحيات] |
|---|
| النقاط | 19 |
|---|