Sigma File Manager
Monthly
Server-side request forgery in Sigma File Manager through 2.2.0 allows a malicious extension or poisoned catalog entry to point extension download commands at loopback, RFC1918, or cloud metadata endpoints, with the fetched response materializing as a file inside the extension directory rather than being streamed back to the attacker. The Tauri/Rust backend's validate_remote_url() in src-tauri/src/extensions/security.rs inspects the URL string but never checks the IP addresses the hostname resolves to, so a name resolving to 127.0.0.1 or 169.254.169.254 passes validation. Exploitation is conditional on the user installing or adding the attacker-supplied extension (CVSS 3.1 AV:N/AC:L/PR:N/UI:R, C:L only); no public exploit code identified at time of analysis and the issue is not in CISA KEV. Risk is highest when the app runs on a cloud instance exposing an instance-metadata endpoint.
Server-side request forgery in Sigma File Manager through 2.2.0 allows a malicious extension or poisoned catalog entry to point extension download commands at loopback, RFC1918, or cloud metadata endpoints, with the fetched response materializing as a file inside the extension directory rather than being streamed back to the attacker. The Tauri/Rust backend's validate_remote_url() in src-tauri/src/extensions/security.rs inspects the URL string but never checks the IP addresses the hostname resolves to, so a name resolving to 127.0.0.1 or 169.254.169.254 passes validation. Exploitation is conditional on the user installing or adding the attacker-supplied extension (CVSS 3.1 AV:N/AC:L/PR:N/UI:R, C:L only); no public exploit code identified at time of analysis and the issue is not in CISA KEV. Risk is highest when the app runs on a cloud instance exposing an instance-metadata endpoint.