| Titel | AeternaLabsHQ pullmd v3.2.0 .NET Misconfiguration: Use of Impersonation |
|---|
| Beschreibung | https://github.com/AeternaLabsHQ/pullmd
Server-Side Request Forgery (SSRF) in PullMD via Unvalidated URL Parameter in /api Endpoint
A critical Server-Side Request Forgery (SSRF) vulnerability exists in AeternaLabsHQ/PullMD. The application exposes a REST API endpoint at /api that accepts a url parameter and fetches the referenced resource server-side, converting its content into Markdown. Due to a complete lack of input validation, URL scheme restrictions, and internal network filtering, an unauthenticated remote attacker can supply arbitrary URLs including cloud metadata endpoints (e.g., http://x.x.x.x/latest/user-data, http://x.x.x.x/latest/meta-data/) and internal network addresses. Successful exploitation allows attackers to retrieve sensitive cloud instance metadata, user-data initialization scripts containing backdoor accounts, SSH public keys, sudo configurations, and potentially cloud IAM temporary credentials. Additionally, attackers can perform port scanning of localhost and internal networks, enumerate unauthenticated internal services, and in some configurations read local files via the file:// protocol. This leads to full server compromise, lateral movement within the cloud environment, and exposure of sensitive infrastructure information. The vulnerability is caused by the absence of an allowlist-based URL validation mechanism, lack of DNS rebinding protection, and no restriction on requests to link-local or private IP ranges. Immediate mitigation should include implementing strict URL allowlisting, blocking requests to internal and metadata IP ranges (x.x.x.x, x.x.x.x, RFC1918 addresses), disabling support for non-HTTP protocols, and deploying network-level egress filtering. |
|---|
| Quelle | ⚠️ https://github.com/AeternaLabsHQ/pullmd/issues/41 |
|---|
| Benutzer | lqz8686 (UID 99538) |
|---|
| Einreichung | 04.07.2026 07:52 (vor 2 Monaten) |
|---|
| Moderieren | 19.08.2026 20:22 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 393282 [AeternaLabsHQ PullMD 3.2.0 REST API Endpoint /api url erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|