Sencho
Monthly
Server-side request forgery in Studio-Saelix Sencho up to 0.94.1 allows an authenticated user who can configure git sources to make the backend issue outbound HTTP/HTTPS connections to attacker-chosen internal addresses by manipulating the repo_url argument handled by outboundTarget.ts in the git-sources Browse API endpoint. Exploitation requires a valid session with git-source administration rights (CVSS 3.1 PR:L), and impact is limited to low confidentiality - internal request issuance and response exposure - with no integrity or availability effect; publicly available exploit code exists, though no confirmed in-the-wild activity has been reported. The vendor disputes the CVE characterization, arguing repository access to private LAN, VPC, VPN, CGNAT and IPv6 ULA ranges is an intentional administrative feature rather than a privilege-boundary bypass, while nonetheless shipping defense-in-depth hardening.
Server-side request forgery in Studio-Saelix Sencho up to 0.97.1 allows an authenticated user with node-management permission to supply a crafted URL to the Add Remote Node API endpoint, where the isValidRemoteUrl function in backend/src/utils/validation.ts fails to block server-side requests. Publicly available exploit code exists, and the CVSS 4.0 base score is 2.0; the independent assessment also rates this as a low-priority issue. Per the vendor, the issue demonstrates server-side request capability but not arbitrary internal response exfiltration, so confidentiality, integrity, and availability impact are limited.
Server-side request forgery in Studio-Saelix Sencho up to 0.94.1 allows an authenticated user who can configure git sources to make the backend issue outbound HTTP/HTTPS connections to attacker-chosen internal addresses by manipulating the repo_url argument handled by outboundTarget.ts in the git-sources Browse API endpoint. Exploitation requires a valid session with git-source administration rights (CVSS 3.1 PR:L), and impact is limited to low confidentiality - internal request issuance and response exposure - with no integrity or availability effect; publicly available exploit code exists, though no confirmed in-the-wild activity has been reported. The vendor disputes the CVE characterization, arguing repository access to private LAN, VPC, VPN, CGNAT and IPv6 ULA ranges is an intentional administrative feature rather than a privilege-boundary bypass, while nonetheless shipping defense-in-depth hardening.
Server-side request forgery in Studio-Saelix Sencho up to 0.97.1 allows an authenticated user with node-management permission to supply a crafted URL to the Add Remote Node API endpoint, where the isValidRemoteUrl function in backend/src/utils/validation.ts fails to block server-side requests. Publicly available exploit code exists, and the CVSS 4.0 base score is 2.0; the independent assessment also rates this as a low-priority issue. Per the vendor, the issue demonstrates server-side request capability but not arbitrary internal response exfiltration, so confidentiality, integrity, and availability impact are limited.