EUVD-2026-65455
GHSA-9g26-825h-8v6p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring authenticated session (PR:L); scope changes to cloud metadata and internal systems (S:C/C:H); no integrity or availability impact demonstrated.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata endpoints by triggering connection health checks or peer connection operations.
AnalysisAI
Server-side request forgery in Ech0 before version 4.7.3 allows authenticated users to pivot through the application server to reach internal infrastructure, including cloud provider metadata APIs and Kubernetes service endpoints. The root cause is a missing URL-validation call: fetchPeerConnectInfo in internal/service/connect/connect.go invokes the unguarded SendRequest helper rather than the SendSafeRequest variant that enforces ValidatePublicHTTPURL private-IP blocking. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated Ech0 user session with a bearer token (CVSS PR:L) - the attacker must possess a legitimate account or have stolen a session token; no administrative privileges are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) accurately represents the threat profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated attacker creates a peer connection record in Ech0 with `connect_url` set to `http://169.254.169.254/latest/meta-data/iam/security-credentials/` and then calls the health-check API endpoint, causing the Ech0 server to fetch the AWS instance metadata URL and return IAM role credentials in the response body. A working proof-of-concept for both AWS IMDSv1 and Kubernetes API enumeration is publicly available in the GHSA advisory GHSA-8mc6-xjpr-h98x, requiring only a valid bearer token. |
| Remediation | Upgrade Ech0 to version 4.7.3 or later, which corrects `fetchPeerConnectInfo` to use `SendSafeRequest` instead of `SendRequest`, thereby enforcing `ValidatePublicHTTPURL` private-IP and link-local address blocking. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all Ech0 instances and their versions, and implement network segmentation to block the application server's outbound access to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an a
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incom
Denial of service in Ech0 before 5.0.1 allows unauthenticated remote attackers to saturate server CPU by exploiting a qu
Authorization bypass in Ech0 before 4.5.1 allows any authenticated non-admin user to invoke privileged admin endpoints b
Privilege escalation in Ech0 before 4.4.3 allows an attacker holding an admin's profile:read access token to change the
Scope enforcement in Ech0 4.3.4 and earlier is opt-in at the route level, meaning privileged admin routes that omit the
Missing administrator authorization on dashboard log endpoints in Ech0 before 4.4.3 allows any authenticated low-privile
Scope enforcement bypass in Ech0's comment panel admin API allows any holder of a valid admin-issued access token - rega
Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count
Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.
Ech0 before version 4.7.3 exposes guest commenter email addresses to unauthenticated remote callers via public comment-l
Unsalted MD5 password hashing in Ech0's `MD5Encrypt` function (`internal/util/crypto/crypto.go`) stores credentials in a
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today