CVE-2026-116069 in NiubiGEO
Summary
by MITRE • 10/25/2026
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts to read loopback, internal-network, or cloud metadata responses returned in the plan's siteEvidence JSON.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in NiubiGEO versions prior to 0.3.2 represents a critical server-side request forgery flaw that stems from insufficient validation of user-supplied input within the application logic. Specifically, the POST endpoint /audit-plan fails to properly sanitize or restrict domain values provided by remote attackers. This lack of rigorous input validation allows an adversary to manipulate the target host into initiating HTTP requests to arbitrary destinations controlled by the attacker. The core technical failure lies in the absence of a robust allowlist for destination hosts and the missing implementation of security controls designed to prevent access to internal network resources, such as loopback interfaces or private IP ranges.
From an operational perspective, this vulnerability enables remote unauthenticated attackers to force the NiubiGEO server to fetch content from internal addresses. By supplying crafted domain values that resolve to localhost, private networks, or link-local hosts, an attacker can exploit the application's trust in its own environment. The impact is particularly severe because the responses returned by these internal services are embedded within the plan's siteEvidence JSON field and subsequently exposed back to the client. This mechanism effectively turns the vulnerable server into a proxy for accessing sensitive internal infrastructure that would otherwise be inaccessible from external networks, bypassing standard network perimeter defenses.
The exploitation of this flaw aligns with Common Weakness Enumeration (CWE) category CWE-918, which describes Server-Side Request Forgery where the web server makes requests to internally configured resources based on user input without adequate validation. Furthermore, in terms of tactical classification under the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Discovery and Collection, specifically allowing attackers to gather information about internal network topology and potentially access cloud metadata services if deployed within such environments. The ability to read loopback responses can lead to further compromise by exposing authentication tokens or configuration details hosted on local administrative interfaces.
To mitigate this risk, immediate remediation involves upgrading NiubiGEO to version 0.3.2 or later where the issue has been addressed. In addition to patching, organizations should implement strict input validation mechanisms that enforce a whitelist of allowed domains for any outbound requests initiated by the server. It is also recommended to configure network-level controls such as firewall rules or proxy settings to block outgoing connections from application servers to internal IP ranges and cloud metadata endpoints unless explicitly required for business functionality. Regular security audits focusing on SSRF prevention patterns should be conducted to ensure that similar vulnerabilities are not present in other components of the system architecture.