Mediaflow Proxy
Monthly
Server-side request forgery in MediaFlow Proxy through 2.4.9 lets remote, unauthenticated attackers force the proxy to fetch arbitrary internal URLs - including loopback services and cloud metadata endpoints such as 169.254.169.254 - and read the full responses back through the d query parameter on the /proxy routes. Two weaknesses combine: the forward route's destination check validated only numeric private/loopback/link-local IP literals, so hostnames like localhost or nip.io-style names that resolve to internal addresses bypassed it, while the /proxy/stream endpoint performed no internal-address check at all, leaving even bare metadata IP literals reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); practical risk depends heavily on deployment, with the highest impact where the instance is internet-reachable and runs in a cloud environment that exposes a metadata service.
Server-side request forgery in MediaFlow Proxy through 2.4.9 lets remote, unauthenticated attackers force the proxy to fetch arbitrary internal URLs - including loopback services and cloud metadata endpoints such as 169.254.169.254 - and read the full responses back through the d query parameter on the /proxy routes. Two weaknesses combine: the forward route's destination check validated only numeric private/loopback/link-local IP literals, so hostnames like localhost or nip.io-style names that resolve to internal addresses bypassed it, while the /proxy/stream endpoint performed no internal-address check at all, leaving even bare metadata IP literals reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); practical risk depends heavily on deployment, with the highest impact where the instance is internet-reachable and runs in a cloud environment that exposes a metadata service.