Ghcr Io Aliasvault Aliasvault
Monthly
Server-side request forgery via DNS rebinding in the AliasVault self-hosted server's favicon extractor (versions prior to 0.30.3) allows an authenticated, low-privileged user to make the server issue HTTP/HTTPS requests to internal hosts and read back limited information about them. The flaw is a time-of-check/time-of-use race (CWE-367): the API validates a user-supplied hostname with one DNS lookup, but the HTTP client performs a second, independent lookup when connecting, so an attacker-controlled authoritative DNS server can answer with a public address during validation and a private address during connection. Exploitation is conditional and moderate in severity rather than urgent - it requires a publicly reachable self-hosted instance with public registration enabled, a valid AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit outbound requests to ports 80 and 443, and the browser extensions, web application, and mobile apps are not affected. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the vendor released a fix in 0.30.3.
Server-side request forgery via DNS rebinding in the AliasVault self-hosted server's favicon extractor (versions prior to 0.30.3) allows an authenticated, low-privileged user to make the server issue HTTP/HTTPS requests to internal hosts and read back limited information about them. The flaw is a time-of-check/time-of-use race (CWE-367): the API validates a user-supplied hostname with one DNS lookup, but the HTTP client performs a second, independent lookup when connecting, so an attacker-controlled authoritative DNS server can answer with a public address during validation and a private address during connection. Exploitation is conditional and moderate in severity rather than urgent - it requires a publicly reachable self-hosted instance with public registration enabled, a valid AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit outbound requests to ports 80 and 443, and the browser extensions, web application, and mobile apps are not affected. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the vendor released a fix in 0.30.3.