Kitchenowl
Monthly
Server-side request forgery in KitchenOwl through 0.7.10 lets an authenticated household member abuse the recipe-import feature to make the backend fetch attacker-influenced URLs a second time without IP filtering, potentially reaching loopback, private-network, or cloud-metadata services and reading their responses. The attacker must host a publicly reachable page titled "KitchenOwl" whose path matches /recipe/<id> so that local-instance detection fires and the follow-up requests.get() runs outside the hardened client. Impact is limited to information disclosure from internal services reachable by the server (no write, no code execution), and exploitation requires a valid household account; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
KitchenOwl through 0.7.10 allows authenticated users to read category metadata (names, budgets, and colors) from other households due to a broken object-level authorization flaw in the expense and item API operations. The vulnerability requires a valid account and targets the addExpense/updateExpense and addItem/updateItem endpoints, which fail to verify that a supplied category ID belongs to the caller's household. No public exploit code has been identified at time of analysis, and the impact is limited to read-only information disclosure in multi-household deployments.
Server-side request forgery in KitchenOwl through 0.7.10 lets an authenticated household member abuse the recipe-import feature to make the backend fetch attacker-influenced URLs a second time without IP filtering, potentially reaching loopback, private-network, or cloud-metadata services and reading their responses. The attacker must host a publicly reachable page titled "KitchenOwl" whose path matches /recipe/<id> so that local-instance detection fires and the follow-up requests.get() runs outside the hardened client. Impact is limited to information disclosure from internal services reachable by the server (no write, no code execution), and exploitation requires a valid household account; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
KitchenOwl through 0.7.10 allows authenticated users to read category metadata (names, budgets, and colors) from other households due to a broken object-level authorization flaw in the expense and item API operations. The vulnerability requires a valid account and targets the addExpense/updateExpense and addItem/updateItem endpoints, which fail to verify that a supplied category ID belongs to the caller's household. No public exploit code has been identified at time of analysis, and the impact is limited to read-only information disclosure in multi-household deployments.