Studio-Saelix Sencho up to 0.94.1 git-sources Browse API Endpoint outboundTarget.ts repo_url server-side request forgery ⚔ [Disputed]

Summaryinfo

A vulnerability marked as problematic has been reported in Studio-Saelix Sencho up to 0.94.1. This issue affects some unknown processing of the file outboundTarget.ts of the component git-sources Browse API Endpoint. The manipulation of the argument repo_url leads to server-side request forgery. This vulnerability is traded as CVE-2026-108523. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. There are still doubts about whether this vulnerability truly exists. Applying a patch is the recommended action to fix this issue. The vendor explains: "Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification."

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Studio-Saelix Sencho up to 0.94.1. This issue affects an unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. The manipulation of the argument repo_url with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality.

The advisory is shared at gist.github.com. The identification of this vulnerability is CVE-2026-108523. The exploitation is known to be easy. The attack may be initiated remotely. Technical details as well as a public exploit are known.

The exploit is available at gist.github.com. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification."

Applying the patch 79b86ddcd4aefdd6941f098e35990ab397b13c72 is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Studio-Saelix

Name

• Sencho

Version

• 0.94.0
• 0.94.1

License

• open-source

Website

• Product: https://github.com/Studio-Saelix/sencho/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #893367: Studio-Saelix sencho <= 0.94.1 Server-Side Request Forgery (by jpazz)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion