Dim Sum App
Monthly
Server-side request forgery in NonceGeek dim-sum-app's Deno backend lets remote, unauthenticated attackers redirect outbound requests to an arbitrary host by supplying a crafted supabase_url query parameter to the textSearchV2Handler endpoint (deno/main.tsx). Because the handler builds a Supabase client from that attacker-controlled URL and passes the deployment's SUPABASE_SERVICE_ROLE_KEY as the credential, a successful attack both forces the server to issue requests to attacker-chosen destinations and discloses the service-role key to that endpoint, which in standard deployments can be leveraged for full privileged access to the backing Supabase project and, from there, potential impact on any data or services reachable with that key. The issue is confirmed with publicly available exploit code (disclosed via the project's GitHub issue tracker) but is not listed in CISA KEV, so no confirmed in-the-wild exploitation is established; the vendor has published a fix commit.
Server-side request forgery in NonceGeek dim-sum-app's Deno backend lets remote, unauthenticated attackers redirect outbound requests to an arbitrary host by supplying a crafted supabase_url query parameter to the textSearchV2Handler endpoint (deno/main.tsx). Because the handler builds a Supabase client from that attacker-controlled URL and passes the deployment's SUPABASE_SERVICE_ROLE_KEY as the credential, a successful attack both forces the server to issue requests to attacker-chosen destinations and discloses the service-role key to that endpoint, which in standard deployments can be leveraged for full privileged access to the backing Supabase project and, from there, potential impact on any data or services reachable with that key. The issue is confirmed with publicly available exploit code (disclosed via the project's GitHub issue tracker) but is not listed in CISA KEV, so no confirmed in-the-wild exploitation is established; the vendor has published a fix commit.