URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.5%
exploitation probability
0.5%top 62% of all CVEs
observed exploitation
nono source reports it
In short
Tandoor Recipes has a flaw where user search input isn't properly cleaned before being sent to an external food database API. An attacker can inject extra parameters into the request to disable security protections, crash the server, or expose sensitive information.
Technical detail
CWE-74 (Improper Neutralization of Special Elements in Output) via unsafe URL parameter concatenation in the FDC search endpoint. Attacker-controlled query parameter allows injection of `&` characters to override API credentials and inject arbitrary parameters, leading to credential exposure and DoS via malformed upstream requests.
Summary generated and translated by AI from the official description.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the FDC (USDA FoodData Central) search endpoint constructs an upstream API URL by directly interpolating the user-supplied `query` parameter into the URL string without URL-encoding. An attacker can inject additional URL parameters by including `&` characters in the query value. This allows overriding the API key, manipulating upstream query behavior, and causing server crashes (HTTP 500) via malformed requests — a Denial of Service condition. Version 2.6.0 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
TandoorRecipes · recipes