Dradis Ce
Monthly
Server-side request forgery in Dradis Community Edition 5.1.0-5.2.0 allows any authenticated non-admin user to hijack the AI provider configuration and redirect server-initiated HTTP requests to arbitrary URLs, including internal cloud metadata endpoints such as 169.254.169.254. A broken authorization gate in ProvidersController and AgentsController is conditioned on the Ruby constant Dradis::Pro, which is never defined in CE builds, so the admin_required filter is silently skipped for all CE installations. Non-2xx responses from attacker-supplied URLs are reflected verbatim to the attacker's browser via ActionCable/Turbo Stream, enabling exfiltration of internal service content. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Dradis Community Edition 5.1.0-5.2.0 allows any authenticated non-admin user to hijack the AI provider configuration and redirect server-initiated HTTP requests to arbitrary URLs, including internal cloud metadata endpoints such as 169.254.169.254. A broken authorization gate in ProvidersController and AgentsController is conditioned on the Ruby constant Dradis::Pro, which is never defined in CE builds, so the admin_required filter is silently skipped for all CE installations. Non-2xx responses from attacker-supplied URLs are reflected verbatim to the attacker's browser via ActionCable/Turbo Stream, enabling exfiltration of internal service content. No public exploit code or CISA KEV listing has been identified at time of analysis.