Quickwit
Monthly
Server-side request forgery in Quickwit through 0.9.0 allows remote attackers to coerce a Quickwit node into issuing HTTP requests to arbitrary internal addresses by supplying a crafted queue_url when creating an SQS file source. Because Quickwit ships without built-in authentication, any deployment whose management/create-source REST API is network-reachable is effectively unauthenticated against this attack; the only real prerequisite is that the SQS file source feature be usable and that a source definition containing an attacker-chosen queue_url can be POSTed. Exploitation is blind - the attacker learns only whether a connection succeeded, timed out, or errored - so impact is confined to internal network scanning and service fingerprinting from the node's network position, and no public exploit was identified at time of analysis.
Server-side request forgery in Quickwit through 0.9.0 allows remote attackers to coerce a Quickwit node into issuing HTTP requests to arbitrary internal addresses by supplying a crafted queue_url when creating an SQS file source. Because Quickwit ships without built-in authentication, any deployment whose management/create-source REST API is network-reachable is effectively unauthenticated against this attack; the only real prerequisite is that the SQS file source feature be usable and that a source definition containing an attacker-chosen queue_url can be POSTed. Exploitation is blind - the attacker learns only whether a connection succeeded, timed out, or errored - so impact is confined to internal network scanning and service fingerprinting from the node's network position, and no public exploit was identified at time of analysis.