Koito
Monthly
Server-side request forgery in gabehf/Koito through v0.3.2 lets authenticated users coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via the album image endpoint. The CVSS scope-change rating (S:C) reflects that exploitation reaches beyond the vulnerable component itself - an attacker can pivot through the server to probe cloud metadata services, internal APIs, or RFC-1918 hosts unreachable directly from the internet. No public exploit or active exploitation is identified at time of analysis, but the low attack complexity and lack of URL validation make this straightforward to abuse once authenticated.
Server-side request forgery in gabehf/Koito through v0.3.2 lets authenticated users coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via the album image endpoint. The CVSS scope-change rating (S:C) reflects that exploitation reaches beyond the vulnerable component itself - an attacker can pivot through the server to probe cloud metadata services, internal APIs, or RFC-1918 hosts unreachable directly from the internet. No public exploit or active exploitation is identified at time of analysis, but the low attack complexity and lack of URL validation make this straightforward to abuse once authenticated.