Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-jqx4-9gpq-rppm
No affected components available
Summary
Due to a validation error in got.scpaping, it is possible to use an HTTP redirect to avoid IP filtering.
Details
In got.scpaping, Summaly first makes a HTTP HEAD request to the page being summarized. It then preforms private IP address checks on the HEAD response, then makes an additional HTTP GET request to the page being summarized. Unfortunately, since private IP address checks aren't performed on the GET response, the GET response can issue a HTTP redirect to a private IP address, which will succeed, regardless of if private IP addresses are allowed by Summaly.
PoC
With a simple Caddy webserver, you can get Summaly to summarize a page hosted via a local IP address:
@summaly-bypass-head {
method HEAD
path /summaly-bypass
}
@summaly-bypass-get {
method GET
path /summaly-bypass
}
header @summaly-bypass-head Content-Type "text/html"
respond @summaly-bypass-head 200
redir @summaly-bypass-get http://127.0.0.1:3080/
Impact
Using this bypass, an attacker can probe a victims internal network for HTTP services that aren't supposed to be exposed to the outside world. While they might only have read-only access through this, it may still be possible to extract sensitive information or be used to probe a network prior to attacking via other exploits without leaving a trace.
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a low impact on the confidentiality of the information.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
Probability that this vulnerability will be exploited in the wild within the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard