| tiêu đề | songxinjianqwe Chat 1.0-SNAPSHOT Server-Side Request Forgery (SSRF) |
|---|
| Mô tả | Chat contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in its chat-server component. The server processes client-supplied TASK messages before authentication and allows a FILE task description to be interpreted as an arbitrary URL. It then performs an HTTP GET request from the server host and returns the response body to the requesting client. A remote attacker who can reach the chat server TCP port may therefore access loopback services, intranet applications, internal APIs, or cloud metadata endpoints reachable from the server environment. The vulnerability affects version 1.0-SNAPSHOT on the master branch and is classified as CWE-918. |
|---|
| Nguồn | ⚠️ https://github.com/HazyX0/cve/issues/1 |
|---|
| Người dùng | Hazyx (UID 100199) |
|---|
| Đệ trình | 29/07/2026 17:10 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 24/09/2026 13:38 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 409334 [songxinjianqwe Chat đến ac63d25297079eed5e4ba7e88d3b7a032637150d chat-server ChatServer.java nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|