EUVD-2026-87328Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed MediaFlow Proxy
-
DeliveryCraft /proxy request with internal d URL
-
ExploitProxy resolves and fetches target
-
ExecutionRead full internal/metadata response
-
ImpactExfiltrate cloud credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of MediaFlow Proxy (through 2.4.9): an attacker simply supplies an internal URL in the d query parameter of a /proxy route. The specific exploitable weaknesses are (1) the /proxy forward route's destination check validated only numeric private/loopback/link-local IP literals, so hostnames resolving to internal addresses (localhost, nip.io-style mappings, DNS-rebinding hosts) bypassed it, and (2) the /proxy/stream endpoint performed no internal-address check at all, making even bare metadata IP literals reachable. The main limiting factor is deployment: the instance must be network-reachable by the attacker, and the highest-value outcome (credential theft) requires the proxy to run in a cloud environment exposing a metadata endpoint. No authentication or user interaction is required. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes a fully remote, unauthenticated, low-complexity SSRF with high confidentiality impact - a genuinely serious combination for any internet-exposed instance. The source-code evidence strongly supports the network/unauthenticated read: the pre-patch |
| Exploit ScenarioDerived | An attacker locates an internet-reachable MediaFlow Proxy instance and sends a request to a /proxy route (e.g. /proxy/stream, which had no guard) with the d parameter set to http://169.254.169.254/latest/meta-data/iam/security-credentials/. The proxy fetches the internal URL and returns the full response body, leaking cloud instance metadata and IAM credentials. Even the guarded forward route was bypassable via hostnames that resolve to internal addresses (localhost, nip.io, or DNS-rebinding hosts); no public exploit code is referenced, though a vendor advisory and regression test confirm the mechanism. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Server-side request forgery in MediaFlow Proxy through 2.4.9 lets remote, unauthenticated attackers force the proxy to fetch arbitrary internal URLs - including loopback services and cloud metadata endpoints such as 169.254.169.254 - and read the full responses back through the d query parameter on the /proxy routes. Two weaknesses combine: the forward route's destination check validated only numeric private/loopback/link-local IP literals, so hostnames like localhost or nip.io-style names that resolve to internal addresses bypassed it, while the /proxy/stream endpoint performed no internal-address check at all, leaving even bare metadata IP literals reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); practical risk depends heavily on deployment, with the highest impact where the instance is internet-reachable and runs in a cloud environment that exposes a metadata service.
RemediationAI
Upstream fix available (commit 99f4af1, https://github.com/mhdzumair/mediaflow-proxy/commit/99f4af1153d4766420a098a232183cba1efdc560); a tagged release version containing that commit is not independently confirmed from the available data, so deployers should apply the commit, track the repository for the corresponding release past 2.4.9, and consult the VulnCheck advisory at https://www.vulncheck.com/advisories/mediaflow-proxy-through-2.4.9-server-side-request-forgery-via-incomplete-validation for vendor guidance. The fix requires no configuration changes: it resolves the destination hostname via getaddrinfo and rejects any address that is private, loopback, link-local, or unspecified, and it extends that check to the /proxy/stream endpoint, so upgrading/rebuilding the container from patched source is sufficient. Where patching cannot be done immediately, apply compensating controls with their trade-offs in mind: deny the proxy process outbound access to RFC1918, loopback, and 169.254.0.0/16 via host firewall, egress proxy, or Kubernetes NetworkPolicy (this blocks the attack path but will also break any legitimate internal-upstream use case); enforce IMDSv2 with hop limit 1 on AWS so unauthenticated GETs to the metadata service fail, and on GCP/Azure require metadata headers or disable the legacy metadata endpoint (note this only protects metadata, not other internal services); place the MediaFlow Proxy instance behind authentication and restrict the /proxy and /proxy/stream endpoints to trusted networks or clients (this reduces exposure but does not fix the underlying validation gap); and monitor proxy egress logs for requests to internal address ranges or the d parameter containing literals such as 169.254.169.254 or hostnames like localhost and nip.io-style names, which serve as detection rather than prevention. Because exploitation requires only network reachability and no credentials, an exposed unpatched instance should be treated as compromised-adjacent - rotate any cloud credentials reachable from the instance if SSRF probing is observed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MediaFlow Proxy (mhdzumair/mediaflow-proxy, tracked as cpe:2.3:a:mhdzumair:mediaflow-proxy:*:*:*:*:*:*:*:*) is a Python/FastAPI-based streaming and media proxying service that exposes /proxy forward and /proxy/stream routes, each accepting a destination through the d query parameter. CWE-918 (Server-Side Request Forgery) applies because the application takes attacker-controlled input and uses it as the target of a server-initiated outbound HTTP request without adequately restricting where that request may go. The vulnerable guard, _check_forward_destination, parsed the hostname and attempted ipaddress.ip_address() on it; when that raised ValueError for a non-literal hostname, the code explicitly treated hostname-based SSRF as the caller's responsibility and allowed the request. Any name whose own DNS resolution lands on 127.0.0.1, RFC1918 space, link-local 169.254.0.0/16, or the unspecified address - localhost, nip.io-style DNS mappings, or DNS-rebinding hosts - therefore passed the check, and the separate /proxy/stream path had no internal-address validation whatsoever. Because the proxy returns the upstream response body to the caller, the SSRF is a full-read primitive rather than a blind one, enabling access to internal admin panels, unauthenticated internal APIs, and cloud instance metadata credentials. The upstream fix refactors validation into an async _check_not_internal_address helper that resolves the hostname via loop.getaddrinfo() and rejects every returned address that is_private, is_loopback, is_link_local, or is_unspecified, and additionally applies that check to the stream endpoint's hostname; a new tests/test_ssrf_guard.py suite covers the private-IP-literal, loopback-hostname, public-hostname, and hostname-bypass cases. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) agree on a fully remote, unauthenticated, low-complexity attack with high confidentiality impact and no integrity or availability impact - consistent with a read-only response exfiltration primitive.
Know when Mediaflow Proxy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated SSRF with no user interaction reads full internal responses (C:H); no meaningful write/integrity or availability impact, so I:N/A:N and PR:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full responses from the proxy server.
Executive ViewAI
MediaFlow Proxy deployments at versions through 2.4.9 carry a high-severity flaw that could let attackers pivot through the proxy to reach internal systems and cloud metadata services, potentially exposing credentials and sensitive data. Organizations running internet-facing instances, particularly in cloud environments, face the greatest risk of lateral movement, data theft, or service disruption. A vendor patch is available, so leadership should prioritize rapid identification and remediation of affected instances.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB