Lespass
Monthly
Server-side request forgery in TiBillet Lespass v1 API allows an authenticated attacker with high privileges to make the server fetch arbitrary URLs supplied through the img_url or image_url argument in the get_img_from_url function, potentially reaching internal services. The vendor confirms the weakness affects versions up to commit 10e87909c5d526dffa6d424c104fc12860740537 and states that destination IP validation, redirect re-checks, and download timeout/size limits are planned for the v2 API. Exploitation is rated difficult (AC:H) and no public exploit was identified at time of analysis; this is a low-priority, vendor-confirmed issue.
Server-side request forgery in TiBillet Lespass v1 API allows an authenticated attacker with high privileges to make the server fetch arbitrary URLs supplied through the img_url or image_url argument in the get_img_from_url function, potentially reaching internal services. The vendor confirms the weakness affects versions up to commit 10e87909c5d526dffa6d424c104fc12860740537 and states that destination IP validation, redirect re-checks, and download timeout/size limits are planned for the v2 API. Exploitation is rated difficult (AC:H) and no public exploit was identified at time of analysis; this is a low-priority, vendor-confirmed issue.