| عنوان | AstrBotDevs AstrBot 4.22.1 Server-Side Request Forgery (SSRF) |
|---|
| الوصف | AstrBot versions up to and including 4.22.1 contain multiple Server-Side Request Forgery (SSRF) vulnerabilities. Several API endpoints accept user-controlled URLs or proxy parameters and make server-side HTTP requests without any URL validation, scheme restriction, or internal network access controls. An attacker can exploit this to access internal network services, cloud instance metadata endpoints, and other resources not intended to be publicly accessible. |
|---|
| المصدر | ⚠️ https://github.com/AstrBotDevs/AstrBot/issues/7171 |
|---|
| المستخدم | Yu_Bao (UID 89348) |
|---|
| ارسال | 30/03/2026 05:51 AM (5 أشهر منذ) |
|---|
| الاعتدال | 11/04/2026 10:50 AM (12 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 356979 [AstrBotDevs AstrBot حتى 4.22.1 API Endpoint post_data.get تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|