Pinepods
Monthly
Authenticated server-side request forgery in PinePods before 0.9.0 allows a low-privilege user, where self-service signup is supported, to make the server issue GET/HEAD requests to loopback, private-network, and cloud metadata endpoints by subscribing to an attacker-controlled RSS feed. The enclosure URL is stored without host/IP validation and later fetched by reqwest with default redirect following, and downloaded responses are saved and recorded, enabling internal-service enumeration, confidential-data disclosure, and possible metadata credential theft. The GitHub advisory includes a reproducible end-to-end proof-of-concept against a default Docker deployment; the issue is fixed in 0.9.0, the vuln.today decision label is act_now, and no CISA KEV entry or EPSS score is provided in the supplied intelligence.
Authenticated server-side request forgery in PinePods before 0.9.0 allows a low-privilege user, where self-service signup is supported, to make the server issue GET/HEAD requests to loopback, private-network, and cloud metadata endpoints by subscribing to an attacker-controlled RSS feed. The enclosure URL is stored without host/IP validation and later fetched by reqwest with default redirect following, and downloaded responses are saved and recorded, enabling internal-service enumeration, confidential-data disclosure, and possible metadata credential theft. The GitHub advisory includes a reproducible end-to-end proof-of-concept against a default Docker deployment; the issue is fixed in 0.9.0, the vuln.today decision label is act_now, and no CISA KEV entry or EPSS score is provided in the supplied intelligence.