Fish Island Backend
Monthly
Server-side request forgery in fish-island-backend through commit 7c61b78 allows unauthenticated remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse, potentially reaching internal hosts, loopback services, and cloud metadata endpoints through redirect-following OkHttp requests. Successful exploitation can disclose limited internal data reflected by the parser, such as page titles, meta descriptions, and favicons, so the practical impact is constrained to what the targeted service returns in those fields. No public exploit code or CISA KEV entry is identified in the provided data, and the assessed CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Server-side request forgery in fish-island-backend through commit 7c61b78 allows unauthenticated remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse, potentially reaching internal hosts, loopback services, and cloud metadata endpoints through redirect-following OkHttp requests. Successful exploitation can disclose limited internal data reflected by the parser, such as page titles, meta descriptions, and favicons, so the practical impact is constrained to what the targeted service returns in those fields. No public exploit code or CISA KEV entry is identified in the provided data, and the assessed CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.