| शीर्षक | InvenTree 1.2.6 Server-Side Request Forgery |
|---|
| विवरण | InvenTree contains a Server-Side Request Forgery (SSRF) vulnerability in its remote image download functionality, where user-supplied URLs are validated only for format using Django’s URLValidator without restricting access to internal or sensitive network locations. The application subsequently performs HTTP requests using requests.get() with redirects enabled, allowing authenticated attackers to supply crafted URLs that target internal services or cloud metadata endpoints such as 169.254.169.254. This can lead to unauthorized access to sensitive information, including cloud instance credentials, and may facilitate further lateral movement within internal infrastructure. |
|---|
| स्रोत | ⚠️ https://github.com/lakshayyverma/CVE-Discovery/blob/main/InvenTree.md |
|---|
| उपयोगकर्ता | lakshay12311 (UID 91298) |
|---|
| सबमिशन | 29/03/2026 12:27 PM (7 महीनों पहले) |
|---|
| संयम | 08/04/2026 09:23 AM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 356037 [InvenTree 1.2.6 remote_image अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|