| शीर्षक | NucleoidAI Nucleoid 0.7.10 Server-Side Request Forgery |
|---|
| विवरण | A Server‑Side Request Forgery (SSRF) vulnerability exists in Nucleoid where the application directly constructs an outbound request URL using runtime values returned by extension.apply(req) (notably ip, port, and path) and issues the request via axios without validating or normalizing the target; if an attacker can influence the values returned by extension.apply(req) (for example via req.query, req.body, headers or other request-derived data), they can coerce the server to make arbitrary HTTP requests to internal or external hosts (including cloud metadata endpoints like x.x.x.x), potentially leading to sensitive information disclosure, internal reconnaissance/port scanning, open‑proxy abuse, or further chained compromises. |
|---|
| स्रोत | ⚠️ https://github.com/lakshayyverma/CVE-Discovery/blob/main/Nucleoid.md |
|---|
| उपयोगकर्ता | lakshay12311 (UID 91298) |
|---|
| सबमिशन | 06/10/2025 04:57 PM (1 वर्ष पहले) |
|---|
| संयम | 16/10/2025 04:28 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 328809 [NucleoidAI Nucleoid तक 0.7.10 Outbound Request /src/cluster.ts extension.apply https/ip/port/path/headers अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|