| tiêu đề | trueleaf apiflow ≤0.9.7 Server-Side Request Forgery |
|---|
| Mô tả | ApiFlow is an API documentation management platform written in TypeScript/Node.js. The HTTP proxy functionality in the server component contains a Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated attackers to bypass URL validation and make arbitrary requests to internal network resources.
The vulnerability exists in the `HttpProxyService` class where URL validation is performed only on the initial request URL, but not on redirect targets. By using an external redirect service, attackers can bypass the IP address allowlist and access internal services such as databases, cloud metadata endpoints, and other sensitive internal resources. |
|---|
| Nguồn | ⚠️ https://www.notion.so/Server-Side-Request-Forgery-SSRF-in-ApiFlow-329ea92a3c4180489df2fa2702078fe5 |
|---|
| Người dùng | din4 (UID 50867) |
|---|
| Đệ trình | 20/03/2026 15:43 (cách đây 7 các tháng) |
|---|
| Kiểm duyệt | 21/03/2026 08:36 (17 hours later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 352316 [trueleaf ApiFlow 0.9.7 URL Validation http_proxy.service.ts validateUrlSecurity nâng cao đặc quyền] |
|---|
| điểm | 17 |
|---|