Pinry
Monthly
Server-side request forgery in Pinry through 2.1.13 enables unauthenticated remote attackers to coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via the pin-from-URL feature, which passes attacker-supplied URLs directly to Python's requests.get() without host allowlisting or IP validation. Because ALLOW_NEW_REGISTRATIONS defaults to true, no account or authentication is required to trigger the vulnerable endpoint, making every default-configured internet-exposed Pinry instance exploitable without any attacker preconditions. Attackers can leverage this to reach cloud metadata endpoints such as AWS IMDSv1 at 169.254.169.254, harvest IAM credentials, or probe internal services unreachable from the public internet; no public exploit has been identified at time of analysis and no CISA KEV listing is present.
Server-side request forgery in Pinry through 2.1.13 enables unauthenticated remote attackers to coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via the pin-from-URL feature, which passes attacker-supplied URLs directly to Python's requests.get() without host allowlisting or IP validation. Because ALLOW_NEW_REGISTRATIONS defaults to true, no account or authentication is required to trigger the vulnerable endpoint, making every default-configured internet-exposed Pinry instance exploitable without any attacker preconditions. Attackers can leverage this to reach cloud metadata endpoints such as AWS IMDSv1 at 169.254.169.254, harvest IAM credentials, or probe internal services unreachable from the public internet; no public exploit has been identified at time of analysis and no CISA KEV listing is present.