Huly Platform through 0.7.426 SSRF via Print Service
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.4%
probabilidade de exploração
0.4%top 72% das CVEs
exploração observada
nãonenhuma fonte reporta
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N
Produtos afetados
hcengineering · platformReferências
https://github.com/hcengineering/platformhttps://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/config.tshttps://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/server.tshttps://github.com/hcengineering/platform/issues/10908https://www.vulncheck.com/advisories/huly-platform-through-0.7.426-ssrf-via-print-service