| शीर्षक | uCrop Android Library 2.2.11 Server-Side Request Forgery |
|---|
| विवरण | Hello, this is arrester. On June 10th, I reported the issue to the official uCrop GitHub repository using the Security tab and even tagged the person in charge during the process, but since I still haven’t received a response, I am now submitting it to VulDB.
The SSRF vulnerability I discovered occurs due to insufficient input validation in the URL handling of the downloadFile function in com.yalantis.ucrop.task.BitmapLoadTask.java. |
|---|
| स्रोत | ⚠️ https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b8512562197804dae69edf96b942446 |
|---|
| उपयोगकर्ता | arrester (UID 93048) |
|---|
| सबमिशन | 27/11/2025 07:36 PM (10 महीनों पहले) |
|---|
| संयम | 11/12/2025 07:46 AM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 335854 [Yalantis uCrop 2.2.11 URL com.yalantis.ucrop.task.BitmapLoadTask.java downloadFile अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|