Keeper Sh
Monthly
DNS rebinding in keeper.sh's calendar module (versions prior to 2.18.14) allows authenticated attackers to bypass the SSRF guard and route outbound HTTP connections to private network addresses, including cloud instance metadata endpoints such as 169.254.169.254. The flaw arises from a two-phase design: the guard resolves a hostname's IP addresses, asserts they are public, then discards those resolved addresses before independently re-resolving the hostname at socket-open time - an attacker controlling authoritative DNS can serve a public IP during validation and swap it to a private IP for the subsequent connection. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 2.18.14.
DNS rebinding in keeper.sh's calendar module (versions prior to 2.18.14) allows authenticated attackers to bypass the SSRF guard and route outbound HTTP connections to private network addresses, including cloud instance metadata endpoints such as 169.254.169.254. The flaw arises from a two-phase design: the guard resolves a hostname's IP addresses, asserts they are public, then discards those resolved addresses before independently re-resolving the hostname at socket-open time - an attacker controlling authoritative DNS can serve a public IP during validation and swap it to a private IP for the subsequent connection. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 2.18.14.