| タイトル | huimeicloud hmEditor 2.2.3 Server-Side Request Forgery |
|---|
| 説明 | A server-side request forgery (SSRF) vulnerability has been identified in hmEditor, a product developed by huimeicloud. The application fails to properly validate user-supplied URLs in multiple request handlers, allowing an attacker to make arbitrary HTTP requests from the server. Specifically, the /image-to-base64 endpoint in src/mcp-server.js accepts a url parameter via HTTP POST requests and passes it directly to the client.get() method without sufficient validation or sanitization. Similarly, the src/print.js component passes user-controlled URLs to Puppeteer's page.goto() method. An attacker can exploit this flaw to probe internal network resources, access sensitive metadata endpoints (e.g., cloud instance metadata services), or interact with other internal systems that are not intended to be exposed. The vulnerability exists because the application trusts user-provided input as the destination for outbound HTTP requests and browser navigation operations without implementing an effective allowlist or blocking dangerous destinations such as loopback addresses or private network ranges.
|
|---|
| ソース | ⚠️ https://github.com/wing3e/public_exp/issues/11 |
|---|
| ユーザー | BigW (UID 96422) |
|---|
| 送信 | 2026年03月16日 19:53 (7 月 ago) |
|---|
| モデレーション | 2026年04月01日 18:04 (16 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 354701 [huimeicloud hm_editor 迄 2.2.3 image-to-base64 Endpoint src/mcp-server.js client.get url 特権昇格] |
|---|
| ポイント | 20 |
|---|