CVE-2026-123207 in LibreTV
Summary
by MITRE • 11/05/2026
LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in LibreTV versions prior to 2.21.2 represents a critical server-side request forgery flaw rooted in improper DNS resolution handling within the application's network communication layer. Specifically, the function fetchWithSafeRedirects fails to pin or validate DNS records at the time of actual connection establishment, relying instead on potentially stale or manipulated resolutions performed during earlier validation phases. This architectural oversight allows an authenticated attacker to exploit a race condition inherent in unpinned DNS lookups by leveraging control over authoritative Domain Name System servers associated with target domains. By manipulating these DNS responses, the attacker can cause the application to resolve a domain name to a public IP address during initial security checks while simultaneously resolving it to a private or loopback IP address when the actual HTTP request is transmitted. This discrepancy effectively bypasses the checkUpstreamAllowed() validation logic which is designed to restrict outbound connections to safe and authorized endpoints, thereby enabling unauthorized access to internal network resources that should remain isolated from external influence.
From an operational perspective, this vulnerability poses a severe risk as it allows authenticated users to pivot into sensitive internal infrastructure through standard API endpoints such as /api/source/test, /api/proxy, /api/search, or /api/detail. The ability to reach loopback services means attackers can interact with local database interfaces, administrative panels, or other backend components running on the same host that are not exposed to the public internet but remain accessible via localhost traffic. Furthermore, cloud metadata endpoints like those found in AWS EC2 instances at 169.254.169.254 become reachable, potentially leading to credential theft and full compromise of underlying infrastructure if the application is deployed within a cloud environment. This aligns with CWE-918 which addresses Server-Side Request Forgery flaws where server-side code makes requests based on user-supplied input without proper validation of the destination's trustworthiness during execution time rather than just at configuration or initial check stages.
The exploitation technique mirrors tactics documented in MITRE ATT&CK framework under T1071 Application Layer Protocol, specifically leveraging DNS tunneling concepts to bypass network security controls by manipulating name resolution processes. It also relates to CWE-442 regarding the use of insecure default configurations where trust is placed too early in the request lifecycle without re-validation at connection time. To mitigate this vulnerability, developers must implement strict DNS pinning or certificate transparency checks within fetchWithSafeRedirects() to ensure that the IP address resolved during validation matches the one used for actual network communication. Additionally, enforcing allowlists of permitted outbound destinations and validating responses against these lists after resolution can prevent redirection to internal ranges. Upgrading to version 2.21.2 or later is essential as it addresses this logic flaw by ensuring consistent DNS handling throughout the request lifecycle, thereby closing the gap that allows authenticated users to bypass security boundaries through manipulated name service responses.